{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"30cda268-cbd6-4f94-bf75-397bf32015ca"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"30cda268-cbd6-4f94-bf75-397bf32015ca","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":840997250,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42488},"address":"10.133.0.28:42488"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30cda268-cbd6-4f94-bf75-397bf32015ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42492","PortSpecifier":{"PortValue":42492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42492","PortSpecifier":{"PortValue":42492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":852281936},"http":{"id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eb628b39-8b62-4c32-a058-a712fe4f7f82"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":852281936,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42492},"address":"10.133.0.28:42492"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb628b39-8b62-4c32-a058-a712fe4f7f82","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2614bd22-b727-4447-8376-12f915ac5169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42500","PortSpecifier":{"PortValue":42500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2614bd22-b727-4447-8376-12f915ac5169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42500","PortSpecifier":{"PortValue":42500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":863740430},"http":{"id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2614bd22-b727-4447-8376-12f915ac5169","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2614bd22-b727-4447-8376-12f915ac5169"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2614bd22-b727-4447-8376-12f915ac5169","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":863740430,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42500},"address":"10.133.0.28:42500"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2614bd22-b727-4447-8376-12f915ac5169","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2614bd22-b727-4447-8376-12f915ac5169","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2614bd22-b727-4447-8376-12f915ac5169","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42506","PortSpecifier":{"PortValue":42506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42506","PortSpecifier":{"PortValue":42506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":875641799},"http":{"id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b2c3eeb1-718b-4987-bbc4-56995cb54661"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":875641799,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42506},"address":"10.133.0.28:42506"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2c3eeb1-718b-4987-bbc4-56995cb54661","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42522","PortSpecifier":{"PortValue":42522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42522","PortSpecifier":{"PortValue":42522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":887044077},"http":{"id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3db1a879-27cf-4c99-8bc1-1705ef09266d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":887044077,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42522},"address":"10.133.0.28:42522"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3db1a879-27cf-4c99-8bc1-1705ef09266d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42532","PortSpecifier":{"PortValue":42532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42532","PortSpecifier":{"PortValue":42532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":898295306},"http":{"id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"57a920b8-dd0c-4f8a-9379-4151527ac144"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"57a920b8-dd0c-4f8a-9379-4151527ac144","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":898295306,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42532},"address":"10.133.0.28:42532"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a920b8-dd0c-4f8a-9379-4151527ac144","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42546","PortSpecifier":{"PortValue":42546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42546","PortSpecifier":{"PortValue":42546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":926647962},"http":{"id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":926647962,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42546},"address":"10.133.0.28:42546"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2c335f3-539f-45e7-b93e-2cbb4808fd1e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42550","PortSpecifier":{"PortValue":42550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42550","PortSpecifier":{"PortValue":42550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":938754859},"http":{"id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":938754859,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42550},"address":"10.133.0.28:42550"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"331268f0-6ac2-48e4-bdd7-ff6029f7f359","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":950435400},"http":{"id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fa450b4c-2002-4411-b938-a20cb48828ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fa450b4c-2002-4411-b938-a20cb48828ba","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":950435400,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42566},"address":"10.133.0.28:42566"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa450b4c-2002-4411-b938-a20cb48828ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42582","PortSpecifier":{"PortValue":42582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42582","PortSpecifier":{"PortValue":42582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":962587115},"http":{"id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c20c2db-3134-4d86-9a16-e0920f636326"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c20c2db-3134-4d86-9a16-e0920f636326","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":962587115,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42582},"address":"10.133.0.28:42582"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c20c2db-3134-4d86-9a16-e0920f636326","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42592","PortSpecifier":{"PortValue":42592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42592","PortSpecifier":{"PortValue":42592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":973953342},"http":{"id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":973953342,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42592},"address":"10.133.0.28:42592"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d433ca2-ce6c-4ca8-9e59-3eab098965f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":985626368},"http":{"id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":985626368,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42604},"address":"10.133.0.28:42604"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ca61ede-e33e-4c39-b3e8-f0559e34deb9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42618","PortSpecifier":{"PortValue":42618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42618","PortSpecifier":{"PortValue":42618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893578,"nanos":997370315},"http":{"id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":997370315,"seconds":1783893578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42618},"address":"10.133.0.28:42618"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb7efde-e2ae-4adf-8a80-9b7a3dbbc4da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42634","PortSpecifier":{"PortValue":42634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42634","PortSpecifier":{"PortValue":42634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":30767530},"http":{"id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":30767530,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42634},"address":"10.133.0.28:42634"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"78405f14-dc04-40b7-bb2a-fa3f01eecbc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42638","PortSpecifier":{"PortValue":42638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42638","PortSpecifier":{"PortValue":42638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":42732783},"http":{"id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a1a335fb-7765-466e-8678-c8ecbe2e9949"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":42732783,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42638},"address":"10.133.0.28:42638"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a335fb-7765-466e-8678-c8ecbe2e9949","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42644","PortSpecifier":{"PortValue":42644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42644","PortSpecifier":{"PortValue":42644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":54068627},"http":{"id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":54068627,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42644},"address":"10.133.0.28:42644"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db3b0a47-4806-4c9a-af5a-ffe6f941330b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42654","PortSpecifier":{"PortValue":42654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42654","PortSpecifier":{"PortValue":42654}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":65413926},"http":{"id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"68fa122e-42ae-4944-b449-879ab1af49f4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"68fa122e-42ae-4944-b449-879ab1af49f4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":65413926,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42654},"address":"10.133.0.28:42654"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68fa122e-42ae-4944-b449-879ab1af49f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42658","PortSpecifier":{"PortValue":42658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42658","PortSpecifier":{"PortValue":42658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":77634083},"http":{"id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e430e699-2a8a-9924-bd00-03fcb9877fbc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":77634083,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42658},"address":"10.133.0.28:42658"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e430e699-2a8a-9924-bd00-03fcb9877fbc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42660","PortSpecifier":{"PortValue":42660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42660","PortSpecifier":{"PortValue":42660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":89257765},"http":{"id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3e989cec-c07b-411a-9e73-01b8d09b4655"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3e989cec-c07b-411a-9e73-01b8d09b4655","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":89257765,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42660},"address":"10.133.0.28:42660"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e989cec-c07b-411a-9e73-01b8d09b4655","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42674","PortSpecifier":{"PortValue":42674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42674","PortSpecifier":{"PortValue":42674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":130480997},"http":{"id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0344e469-0e0f-416e-9f19-2fd648984e9f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0344e469-0e0f-416e-9f19-2fd648984e9f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":130480997,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42674},"address":"10.133.0.28:42674"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0344e469-0e0f-416e-9f19-2fd648984e9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42684","PortSpecifier":{"PortValue":42684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42684","PortSpecifier":{"PortValue":42684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":142187065},"http":{"id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":142187065,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42684},"address":"10.133.0.28:42684"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c01d8d-1dcd-43e6-b1de-0a8be47b0fa8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42690","PortSpecifier":{"PortValue":42690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42690","PortSpecifier":{"PortValue":42690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":154374642},"http":{"id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":154374642,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42690},"address":"10.133.0.28:42690"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13ab9042-af8e-4715-a6b0-de1a83c1d33d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42694","PortSpecifier":{"PortValue":42694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42694","PortSpecifier":{"PortValue":42694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":166175281},"http":{"id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"24f12ede-cf2f-4fba-9608-e4be51b1c444"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":166175281,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42694},"address":"10.133.0.28:42694"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f12ede-cf2f-4fba-9608-e4be51b1c444","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42708","PortSpecifier":{"PortValue":42708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42708","PortSpecifier":{"PortValue":42708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":177617636},"http":{"id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a87d0681-bc40-4945-9479-849fd44b086d","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a87d0681-bc40-4945-9479-849fd44b086d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a87d0681-bc40-4945-9479-849fd44b086d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":177617636,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42708},"address":"10.133.0.28:42708"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a87d0681-bc40-4945-9479-849fd44b086d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a87d0681-bc40-4945-9479-849fd44b086d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42720","PortSpecifier":{"PortValue":42720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42720","PortSpecifier":{"PortValue":42720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":189145216},"http":{"id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b919bb3d-fd43-4192-a199-c4310882872e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b919bb3d-fd43-4192-a199-c4310882872e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b919bb3d-fd43-4192-a199-c4310882872e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":189145216,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42720},"address":"10.133.0.28:42720"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b919bb3d-fd43-4192-a199-c4310882872e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b919bb3d-fd43-4192-a199-c4310882872e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42736","PortSpecifier":{"PortValue":42736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42736","PortSpecifier":{"PortValue":42736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":206539711},"http":{"id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":206539711,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42736},"address":"10.133.0.28:42736"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0465294-ded6-4e4d-aa90-e6450c6eb5bf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42752","PortSpecifier":{"PortValue":42752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42752","PortSpecifier":{"PortValue":42752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":228557809},"http":{"id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"439bd09a-347a-4123-b197-2e7e32f60941","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"439bd09a-347a-4123-b197-2e7e32f60941"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"439bd09a-347a-4123-b197-2e7e32f60941","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":228557809,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42752},"address":"10.133.0.28:42752"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"439bd09a-347a-4123-b197-2e7e32f60941","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"439bd09a-347a-4123-b197-2e7e32f60941","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42768","PortSpecifier":{"PortValue":42768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42768","PortSpecifier":{"PortValue":42768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":240487225},"http":{"id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":240487225,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42768},"address":"10.133.0.28:42768"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4cdef91-b90b-4cdd-8dd5-49279cb6ce57","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42772","PortSpecifier":{"PortValue":42772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42772","PortSpecifier":{"PortValue":42772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":252272426},"http":{"id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":252272426,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42772},"address":"10.133.0.28:42772"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c9d7a0cb-a984-48a9-b6a4-c2c52e876868","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42780","PortSpecifier":{"PortValue":42780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42780","PortSpecifier":{"PortValue":42780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":264854043},"http":{"id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":264854043,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42780},"address":"10.133.0.28:42780"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7ec8074-bef1-418f-b56c-c6ba2e39cb6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42790","PortSpecifier":{"PortValue":42790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42790","PortSpecifier":{"PortValue":42790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":277202597},"http":{"id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":277202597,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42790},"address":"10.133.0.28:42790"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"94135aaa-0fc9-4467-9a38-44dc08fd49b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42796","PortSpecifier":{"PortValue":42796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42796","PortSpecifier":{"PortValue":42796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":288730194},"http":{"id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"266ef1db-4d1b-4587-a16b-91787638318c","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"266ef1db-4d1b-4587-a16b-91787638318c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"266ef1db-4d1b-4587-a16b-91787638318c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":288730194,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42796},"address":"10.133.0.28:42796"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"266ef1db-4d1b-4587-a16b-91787638318c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"266ef1db-4d1b-4587-a16b-91787638318c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42806","PortSpecifier":{"PortValue":42806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":330999092},"http":{"id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":330999092,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42806},"address":"10.133.0.28:42806"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5546f3b9-d0ed-4867-a7c0-a824e2b3b7e3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42812","PortSpecifier":{"PortValue":42812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42812","PortSpecifier":{"PortValue":42812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":343448106},"http":{"id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":343448106,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42812},"address":"10.133.0.28:42812"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4ac6ae3-4634-4ff4-bf50-d6151223f9f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42824","PortSpecifier":{"PortValue":42824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42824","PortSpecifier":{"PortValue":42824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":355470708},"http":{"id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6151af39-0e24-4b2d-878e-a608939af0a5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6151af39-0e24-4b2d-878e-a608939af0a5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":355470708,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42824},"address":"10.133.0.28:42824"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6151af39-0e24-4b2d-878e-a608939af0a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42826","PortSpecifier":{"PortValue":42826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42826","PortSpecifier":{"PortValue":42826}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":367863960},"http":{"id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c21b506c-646a-4f65-9231-6c8f32a43c30"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c21b506c-646a-4f65-9231-6c8f32a43c30","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":367863960,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42826},"address":"10.133.0.28:42826"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c21b506c-646a-4f65-9231-6c8f32a43c30","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42834","PortSpecifier":{"PortValue":42834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42834","PortSpecifier":{"PortValue":42834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":379824746},"http":{"id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":379824746,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42834},"address":"10.133.0.28:42834"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2ac96ca-1980-4079-9e83-d36ec391b2f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42844","PortSpecifier":{"PortValue":42844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42844","PortSpecifier":{"PortValue":42844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":391819678},"http":{"id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":391819678,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42844},"address":"10.133.0.28:42844"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a0c9118-4f3a-462b-bac3-20ed20e5b39e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42852","PortSpecifier":{"PortValue":42852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42852","PortSpecifier":{"PortValue":42852}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":430827969},"http":{"id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":430827969,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42852},"address":"10.133.0.28:42852"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c84b7d3-24b4-4d9f-8d38-48dad3381442","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42866","PortSpecifier":{"PortValue":42866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.28:42866","PortSpecifier":{"PortValue":42866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":443389934},"http":{"id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY\"}"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","input":{"auth":{"identity":"Bearer **** sk-oai-1U4tJZc6mhFCqsVO2_n0ClpIdKqYOw0tAQ1Yv2NJerif6xXxFu2Uu8uc5IVPY","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.28","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.28","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":443389934,"seconds":1783893579}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":42866},"address":"10.133.0.28:42866"}}}}},"destination":{"address":"10.132.0.47:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf8f9ad8-0556-42e3-a7e3-d9bf6d777a2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07027361-edee-4f19-8411-4d0f96cec13f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54658","PortSpecifier":{"PortValue":54658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07027361-edee-4f19-8411-4d0f96cec13f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54658","PortSpecifier":{"PortValue":54658}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783893579,"nanos":740265816},"http":{"id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","headers":{":authority":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0",":scheme":"https","accept":"*/*","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"07027361-edee-4f19-8411-4d0f96cec13f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:maas-admin:tester-admin-user","uid":"caa59ad8-3595-400c-a0e7-70eb3acb966c","groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=35ee2171-af3d-4970-aece-3cf67240afeb"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/029f74d4e359"]}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07027361-edee-4f19-8411-4d0f96cec13f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/029f74d4e359"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=35ee2171-af3d-4970-aece-3cf67240afeb"]},"groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"uid":"caa59ad8-3595-400c-a0e7-70eb3acb966c","username":"system:serviceaccount:maas-admin:tester-admin-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0",":scheme":"https","accept":"*/*","authorization":"Bearer **** ****REDACTED_JWT****","forwarded":"for=34.228.250.194;host=maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com;proto=https","user-agent":"curl/7.76.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctbHBwOGQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.47~maas-default-gateway-openshift-default-56654dcf7-lpp8d.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.11","x-forwarded-host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"07027361-edee-4f19-8411-4d0f96cec13f"},"host":"maas.apps.f2d653e1-60d8-49f4-a8ec-029f74d4e359.prod.konfluxeaas.com","id":"07027361-edee-4f19-8411-4d0f96cec13f","method":"DELETE","path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":740265816,"seconds":1783893579},"url_path":"/maas-api/v1/api-keys/c7a86561-7a2f-411b-ad3c-7c14477b77f0","user_agent":"curl/7.76.1"},"source":{"address":"10.133.0.11:54658","port":54658}}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07027361-edee-4f19-8411-4d0f96cec13f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T21:59:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07027361-edee-4f19-8411-4d0f96cec13f","authorized":true,"response":"OK"}