{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d198e866dbfcf9fc4c1d3cb4b0b144166136aaad40fbd57a888f1a72288ca70","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8bc290902e5f8d0f4f97536be51ac12df5f7a11ebfbce60cae3117da294c114"}
{"level":"error","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d198e866dbfcf9fc4c1d3cb4b0b144166136aaad40fbd57a888f1a72288ca70"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T00:53:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"error","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T00:53:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T00:53:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36600","PortSpecifier":{"PortValue":36600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36600","PortSpecifier":{"PortValue":36600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768014,"nanos":835096560},"http":{"id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"]}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ad4f120-620c-4fc2-b5fa-3c43dc8553f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af907615-c624-4608-abec-18ab07da3292","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33290","PortSpecifier":{"PortValue":33290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af907615-c624-4608-abec-18ab07da3292","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af907615-c624-4608-abec-18ab07da3292","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33290","PortSpecifier":{"PortValue":33290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768014,"nanos":879028137},"http":{"id":"af907615-c624-4608-abec-18ab07da3292","method":"POST","headers":{":authority":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af907615-c624-4608-abec-18ab07da3292","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"]}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af907615-c624-4608-abec-18ab07da3292","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d50941/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af907615-c624-4608-abec-18ab07da3292","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af907615-c624-4608-abec-18ab07da3292","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af907615-c624-4608-abec-18ab07da3292","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36606","PortSpecifier":{"PortValue":36606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36606","PortSpecifier":{"PortValue":36606}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768014,"nanos":920201397},"http":{"id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d5e031fb-a886-48b8-ae88-c6b208e06d7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36612","PortSpecifier":{"PortValue":36612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36612","PortSpecifier":{"PortValue":36612}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768015,"nanos":986888356},"http":{"id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fe6a641-d2ef-49d6-9d67-b4e5a2b2f973","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36618","PortSpecifier":{"PortValue":36618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36618","PortSpecifier":{"PortValue":36618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768017,"nanos":25632394},"http":{"id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"34d9cf4f-a54f-43f4-a274-37f2536c9b00","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36624","PortSpecifier":{"PortValue":36624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5aa4005-4fcf-4748-9834-289d8945569e","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36624","PortSpecifier":{"PortValue":36624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768018,"nanos":76396517},"http":{"id":"b5aa4005-4fcf-4748-9834-289d8945569e","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5aa4005-4fcf-4748-9834-289d8945569e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36638","PortSpecifier":{"PortValue":36638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e338cce9-7afb-4743-ba28-fdc4419d598c","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36638","PortSpecifier":{"PortValue":36638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768019,"nanos":115011694},"http":{"id":"e338cce9-7afb-4743-ba28-fdc4419d598c","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e338cce9-7afb-4743-ba28-fdc4419d598c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50546","PortSpecifier":{"PortValue":50546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50546","PortSpecifier":{"PortValue":50546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768020,"nanos":149371055},"http":{"id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0adb7a20-5921-4e88-a2e6-7f255be794d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50554","PortSpecifier":{"PortValue":50554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50554","PortSpecifier":{"PortValue":50554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768021,"nanos":186961285},"http":{"id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c2fe52a-fd6a-43c0-9bb2-90cf9db00e51","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50568","PortSpecifier":{"PortValue":50568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c4d90ba1-b031-46da-946b-ebeca88aef03","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50568","PortSpecifier":{"PortValue":50568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768022,"nanos":224137585},"http":{"id":"c4d90ba1-b031-46da-946b-ebeca88aef03","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dqrMj4Odpsj7UKPC_IwwMcII6ORU3YTbeJo5T2f2GDmS3ywhl17zPX3aO24C\"}"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","subscription":"e2e-rate-iso-a-d6639e","tenant":"e2e-shared-a-59a77d","userId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-d6639e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d6639e"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"507155e2-96ad-4f9b-b2f4-e5aaec8f43ed","keyName":"e2e-rate-a-d6639e","selected_subscription":"e2e-rate-iso-a-d6639e","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-d6639e@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d6639e","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c4d90ba1-b031-46da-946b-ebeca88aef03","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57500","PortSpecifier":{"PortValue":57500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57500","PortSpecifier":{"PortValue":57500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768031,"nanos":56474934},"http":{"id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"]}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.61:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecabc66-26a7-4742-afbf-54cd5a4f19ce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60764","PortSpecifier":{"PortValue":60764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60764","PortSpecifier":{"PortValue":60764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768031,"nanos":95464486},"http":{"id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","method":"POST","headers":{":authority":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"]}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1ffc191bb5a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c217163e-38ef-4505-ac30-6960c00ee359"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"16f9d820-27c8-4ed5-b26f-2854eff9100f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d50941/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"04ec0ed1-b8f6-4055-b3bc-d883af6f1ff6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57502","PortSpecifier":{"PortValue":57502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57502","PortSpecifier":{"PortValue":57502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768031,"nanos":126620563},"http":{"id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo\"}"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","subscription":"e2e-rate-iso-a-1a1b58","tenant":"e2e-shared-a-59a77d","userId":"fafe1238-e11f-4915-922b-b5dae01448af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-1a1b58\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1a1b58"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","selected_subscription":"e2e-rate-iso-a-1a1b58","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-1a1b58@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f106f481-dbe2-49cf-9481-8a9b1e9d9e53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57518","PortSpecifier":{"PortValue":57518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddd600ab-b501-48f9-b57b-7439810ff284","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57518","PortSpecifier":{"PortValue":57518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768032,"nanos":162783844},"http":{"id":"ddd600ab-b501-48f9-b57b-7439810ff284","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo\"}"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","subscription":"e2e-rate-iso-a-1a1b58","tenant":"e2e-shared-a-59a77d","userId":"fafe1238-e11f-4915-922b-b5dae01448af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-1a1b58\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1a1b58"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","selected_subscription":"e2e-rate-iso-a-1a1b58","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-1a1b58@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddd600ab-b501-48f9-b57b-7439810ff284","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57520","PortSpecifier":{"PortValue":57520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","method":"POST","path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions","host":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57520","PortSpecifier":{"PortValue":57520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.61:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768033,"nanos":203879577},"http":{"id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","method":"POST","headers":{":authority":"e2e-shared-a-59a77d.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11gzaxKXV2FpZm6Bh_2B5mP94ih2BMzUS5DMKeTtndAfdko1o8sne22jA2ooo\"}"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","subscription":"e2e-rate-iso-a-1a1b58","tenant":"e2e-shared-a-59a77d","userId":"fafe1238-e11f-4915-922b-b5dae01448af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\",\"requestedSubscription\":\"e2e-rate-iso-a-1a1b58\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-59a77d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-59a77d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1a1b58"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fafe1238-e11f-4915-922b-b5dae01448af","keyName":"e2e-rate-a-1a1b58","selected_subscription":"e2e-rate-iso-a-1a1b58","selected_subscription_key":"ai-tenant-e2e-shared-a-59a77d/e2e-rate-iso-a-1a1b58@ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-59a77d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1a1b58","namespace":"ai-tenant-e2e-shared-a-59a77d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-59a77d/rate-test-model-59a77d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e50458a4-5d0f-42d3-9e9e-87fd11832c51","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60774","PortSpecifier":{"PortValue":60774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","method":"POST","path":"/ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941/v1/completions","host":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60774","PortSpecifier":{"PortValue":60774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784768033,"nanos":239963382},"http":{"id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","method":"POST","headers":{":authority":"e2e-shared-b-d50941.apps.8e4e306e-0494-41c3-b4f2-b1ffc191bb5a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11UHaRs8OtPK053aa_cIdNwF4ppIokjJJmx7SNzEyWTpYzg1DGprSe92dhrHn"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d50941.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11UHaRs8OtPK053aa_cIdNwF4ppIokjJJmx7SNzEyWTpYzg1DGprSe92dhrHn\"}"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d50941.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dce33783-78fc-43bf-bb79-698d61656634","keyName":"e2e-rate-b-1a1b58","subscription":"e2e-rate-iso-b-1a1b58","tenant":"e2e-shared-b-d50941","userId":"dce33783-78fc-43bf-bb79-698d61656634","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d50941.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941\",\"requestedSubscription\":\"e2e-rate-iso-b-1a1b58\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d50941.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d50941","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-1a1b58","namespace":"ai-tenant-e2e-shared-b-d50941","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941"}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-d50941/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-1a1b58"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dce33783-78fc-43bf-bb79-698d61656634","keyName":"e2e-rate-b-1a1b58","selected_subscription":"e2e-rate-iso-b-1a1b58","selected_subscription_key":"ai-tenant-e2e-shared-b-d50941/e2e-rate-iso-b-1a1b58@ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d50941","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-1a1b58","namespace":"ai-tenant-e2e-shared-b-d50941","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-d50941/rate-test-model-d50941"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T00:53:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1fca503-0aee-4d91-8ede-dd5d3f4fb565","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T00:53:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9902a60fdd75859e93fd57770f827b0cee97408f7b96129b8ed3a0568268a1ef"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c11603cd70fed3ba660fd9730c1f5c9130f80d48d520d732cb6dd48ebf9bafe2"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7530b3a75c5b9a3c55faada6fdfb045e60db8d5b7e90a530561a104dfcc05737"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f96efe98009879894146610a7d3f765d4124a283af99eb5e26352a1c7f79da5f"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f080f7bd1ca4d0f38a1629e0af6b9b32a4efc29a78c7eaed425d1e357decbc80"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eef4da2c5723d814c44d1cc2268bf7fd369bbf4c87c09465e950185bd09b0114"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8bc290902e5f8d0f4f97536be51ac12df5f7a11ebfbce60cae3117da294c114"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/be829e126b0b65c47cfbb965535e1c78f14cc74f1d112ab0c5d8d1cca8ad0158"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77ed84c8ccc846ca71f05f43825a8f30a9e0f900d560c4821e913ead4b0d8019"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4830533e4def9ef9848a9f4af5189bbdca51727e8142e182228909e510378c1"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e03897a78678df553741b8b01ad063f207a3f3c10b0f1d172f55dd47606445b"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d006361dc806832d328472e7a279a2fcca195204b37e8736196ec215cac8556"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f699b6c7917a3e501692ee223e5faf07332c1480db02d5dfd4ccee148ea8921"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1f471082275208d2ed933a2b95fb8cec06190531a08994eb1879fd08f3acb427"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/929c1f4613a408f07e4c25cf33fb220aa58b9c77fb20ddc6960c3a2798b72a6a"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9026b85dd56cae75142c32fa89c537f428e10a9b6ca4397095299a78269e1ec7"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04758790a853e96f9b8ee2876a09c86d946133d2e102e58820ceabdf931c104e"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1958e1800ad22e3c2de8fa32aa5b961a8f3655324d938d9ba6ce4923e2621f09"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e70de481511ccbe8c2bc04e528ac8de5625c5d60a95980aa9f2b8ce08fc5ffdf"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/610822c69f4733cbf302f4234b516a47353f6096ae8f1c2f8191aa06c2904a10"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d198e866dbfcf9fc4c1d3cb4b0b144166136aaad40fbd57a888f1a72288ca70"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33195c25b03276e2fffdf7c5eca7a0203997b6b3f210cd0e7e230234bb9385a0"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30fd891045e6177cd39b2a9f868b0f8fe7b20bde9f1dd6d88849fe76f13bfe82"}
{"level":"info","ts":"2026-07-23T00:54:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/68cef298a2aab46d90da12ba13019610862c2cfb83539a080bef4ba6c4c43798"}