{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a7bf0d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68916f6c-3771-4bb4-ae22-56dd076a1e11","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51334","PortSpecifier":{"PortValue":51334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51334","PortSpecifier":{"PortValue":51334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290683,"nanos":805960243},"http":{"id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5\"}"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","subscription":"e2e-rate-iso-a-9d3bcb","tenant":"e2e-shared-a-27cc80","userId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-9d3bcb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9d3bcb"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","selected_subscription":"e2e-rate-iso-a-9d3bcb","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-9d3bcb@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:04:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15119edc-d3ce-48b5-b33b-c33650c2fd10","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23aad953-1839-46e5-8909-500f03379fb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51348","PortSpecifier":{"PortValue":51348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23aad953-1839-46e5-8909-500f03379fb7","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23aad953-1839-46e5-8909-500f03379fb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51348","PortSpecifier":{"PortValue":51348}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290684,"nanos":900450552},"http":{"id":"23aad953-1839-46e5-8909-500f03379fb7","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5\"}"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","subscription":"e2e-rate-iso-a-9d3bcb","tenant":"e2e-shared-a-27cc80","userId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-9d3bcb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23aad953-1839-46e5-8909-500f03379fb7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9d3bcb"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23aad953-1839-46e5-8909-500f03379fb7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","selected_subscription":"e2e-rate-iso-a-9d3bcb","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-9d3bcb@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23aad953-1839-46e5-8909-500f03379fb7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:04:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23aad953-1839-46e5-8909-500f03379fb7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51360","PortSpecifier":{"PortValue":51360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51360","PortSpecifier":{"PortValue":51360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290685,"nanos":939510512},"http":{"id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lxf0T37pbbIuiojN_cCahjNAN2x7GCsA2jL4wZcNh7PTbVWk5Q17Lr0qbsi5\"}"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","subscription":"e2e-rate-iso-a-9d3bcb","tenant":"e2e-shared-a-27cc80","userId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-9d3bcb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9d3bcb"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"548e5e62-bcd8-42ef-958b-0bdbf000612c","keyName":"e2e-rate-a-9d3bcb","selected_subscription":"e2e-rate-iso-a-9d3bcb","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-9d3bcb@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9d3bcb","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:04:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69c1c0e8-a00f-410b-a0cf-a5bd6fd2d07a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46488","PortSpecifier":{"PortValue":46488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63835d5a-cbb4-4f55-8815-03524add1e66","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46488","PortSpecifier":{"PortValue":46488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290707,"nanos":322303044},"http":{"id":"63835d5a-cbb4-4f55-8815-03524add1e66","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6350a84e-9995-410e-b493-3bc98053b013","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"]}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6350a84e-9995-410e-b493-3bc98053b013","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"035b4712ab495d6da3c5c3f3ffff23a811be9f9aabb61bb9fcc4edc5a6841bf1"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63835d5a-cbb4-4f55-8815-03524add1e66","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d360129-187c-43ce-818b-719c7f958cdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52376","PortSpecifier":{"PortValue":52376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d360129-187c-43ce-818b-719c7f958cdd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a7bf0d.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d360129-187c-43ce-818b-719c7f958cdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52376","PortSpecifier":{"PortValue":52376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290707,"nanos":356780961},"http":{"id":"0d360129-187c-43ce-818b-719c7f958cdd","method":"POST","headers":{":authority":"e2e-shared-b-a7bf0d.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0d360129-187c-43ce-818b-719c7f958cdd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6350a84e-9995-410e-b493-3bc98053b013","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"]}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d360129-187c-43ce-818b-719c7f958cdd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6350a84e-9995-410e-b493-3bc98053b013","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"abc3a3e4bf56436328a357fe85d4008c1f574957fcd65eeb8f270d20571bbb11"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a7bf0d.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a7bf0d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d360129-187c-43ce-818b-719c7f958cdd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d360129-187c-43ce-818b-719c7f958cdd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d360129-187c-43ce-818b-719c7f958cdd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03586b55-951d-462f-a387-caa68e964a91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46504","PortSpecifier":{"PortValue":46504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03586b55-951d-462f-a387-caa68e964a91","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03586b55-951d-462f-a387-caa68e964a91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46504","PortSpecifier":{"PortValue":46504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290707,"nanos":388458816},"http":{"id":"03586b55-951d-462f-a387-caa68e964a91","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03586b55-951d-462f-a387-caa68e964a91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03586b55-951d-462f-a387-caa68e964a91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03586b55-951d-462f-a387-caa68e964a91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03586b55-951d-462f-a387-caa68e964a91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03586b55-951d-462f-a387-caa68e964a91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03586b55-951d-462f-a387-caa68e964a91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46520","PortSpecifier":{"PortValue":46520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46520","PortSpecifier":{"PortValue":46520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290708,"nanos":423949830},"http":{"id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa6f62e2-6c8f-47fc-a4db-5af10a5882e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46536","PortSpecifier":{"PortValue":46536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290709,"nanos":460025718},"http":{"id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b43bc84-cd61-4d17-a1ac-87ef386a5b39","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46544","PortSpecifier":{"PortValue":46544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8082929b-382d-4927-9e3c-bda6034e5d28","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46544","PortSpecifier":{"PortValue":46544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290710,"nanos":494051531},"http":{"id":"8082929b-382d-4927-9e3c-bda6034e5d28","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8082929b-382d-4927-9e3c-bda6034e5d28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46556","PortSpecifier":{"PortValue":46556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30061299-3e64-4600-b728-f4f8cc62dbc0","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46556","PortSpecifier":{"PortValue":46556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290711,"nanos":527003497},"http":{"id":"30061299-3e64-4600-b728-f4f8cc62dbc0","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30061299-3e64-4600-b728-f4f8cc62dbc0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46566","PortSpecifier":{"PortValue":46566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a365df7b-26f8-4677-a975-c1a16d6de183","method":"POST","path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions","host":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:46566","PortSpecifier":{"PortValue":46566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290712,"nanos":567213156},"http":{"id":"a365df7b-26f8-4677-a975-c1a16d6de183","method":"POST","headers":{":authority":"e2e-shared-a-27cc80.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eYeGgmZ1fWsEgZHg_WbZrUT1xM1L2veG88z1eJ7sIJZ8mjn79bFh8gZWLLKo\"}"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","subscription":"e2e-rate-iso-a-907ef4","tenant":"e2e-shared-a-27cc80","userId":"0803723e-63c0-402a-b687-96c3483f2722","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\",\"requestedSubscription\":\"e2e-rate-iso-a-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-27cc80.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0803723e-63c0-402a-b687-96c3483f2722","keyName":"e2e-rate-a-907ef4","selected_subscription":"e2e-rate-iso-a-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-a-27cc80/e2e-rate-iso-a-907ef4@ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-27cc80/models/facebook/opt-125m","name":"rate-test-model-27cc80","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-907ef4","namespace":"ai-tenant-e2e-shared-a-27cc80","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-27cc80/rate-test-model-27cc80"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a365df7b-26f8-4677-a975-c1a16d6de183","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0207a58-a658-46e6-88de-457044a42d96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52380","PortSpecifier":{"PortValue":52380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0207a58-a658-46e6-88de-457044a42d96","method":"POST","path":"/ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d/v1/completions","host":"e2e-shared-b-a7bf0d.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0207a58-a658-46e6-88de-457044a42d96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:52380","PortSpecifier":{"PortValue":52380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290712,"nanos":604821630},"http":{"id":"d0207a58-a658-46e6-88de-457044a42d96","method":"POST","headers":{":authority":"e2e-shared-b-a7bf0d.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r3tpnvGMge9RoZM5_YYia2SAtbko1kl7ewxzF300WZrDHz4L26EuZQmHkj7p"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-a7bf0d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r3tpnvGMge9RoZM5_YYia2SAtbko1kl7ewxzF300WZrDHz4L26EuZQmHkj7p\"}"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a7bf0d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2e5cb232-7412-4a6b-acc3-36a82a27f01e","keyName":"e2e-rate-b-907ef4","subscription":"e2e-rate-iso-b-907ef4","tenant":"e2e-shared-b-a7bf0d","userId":"2e5cb232-7412-4a6b-acc3-36a82a27f01e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-a7bf0d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d\",\"requestedSubscription\":\"e2e-rate-iso-b-907ef4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a7bf0d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-a7bf0d/models/facebook/opt-125m","name":"rate-test-model-a7bf0d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-907ef4","namespace":"ai-tenant-e2e-shared-b-a7bf0d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d"}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0207a58-a658-46e6-88de-457044a42d96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a7bf0d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-907ef4"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0207a58-a658-46e6-88de-457044a42d96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2e5cb232-7412-4a6b-acc3-36a82a27f01e","keyName":"e2e-rate-b-907ef4","selected_subscription":"e2e-rate-iso-b-907ef4","selected_subscription_key":"ai-tenant-e2e-shared-b-a7bf0d/e2e-rate-iso-b-907ef4@ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-a7bf0d/models/facebook/opt-125m","name":"rate-test-model-a7bf0d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-907ef4","namespace":"ai-tenant-e2e-shared-b-a7bf0d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a7bf0d/rate-test-model-a7bf0d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0207a58-a658-46e6-88de-457044a42d96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:05:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0207a58-a658-46e6-88de-457044a42d96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c37a86045d9dd366726da50c37e941c33d7153fd55d226da716d571a8068874d"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/040e64741b1b57bac17f2efd4e62b32cb695d1f8baf0bf93a28085916ca45847"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e436e1f8163884f3a1c651e2c1db456ab2077af1d866e291e377c0bf6b906ab7"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6d788d4d935179e0c2950abf7191bb47380ffb157530442c00a5054f051d5f2"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/862a466366420a712237fbbf226cba26d6b2258476530df6ee0b7d56952730ed"}
{"level":"info","ts":"2026-07-29T02:05:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ff232b4469fa73a79ff3cf2ba7f8ba803182f92c2fa7c8ed3093356c7731dec"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1eec8384878933ea8d7ae8c382ec492375c67cb4e71a025470d7e8dcfd88911"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c352baf9f3648848ca6602c919d6f93f7503f3c191a5c51449046dc2ae0787d"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/06d367266cc60e5f9e050e66a4815da6dd186d166e80225c0d4c8a5d8812b950"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2405df44097683343669247010ecf37b7b535546bf6fef8ee3c0f1d4861c82dc"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45c089d810c1a8b3735d9f2a5f97fc0df02918186a4f3722d9d7c3e1ddec5083"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb20f9b8923a0b2853c7b04e567ec9a5d2632a702280adaa3dbfbc4dc9ec91f4"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/abc3a3e4bf56436328a357fe85d4008c1f574957fcd65eeb8f270d20571bbb11"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cdefc7a173a925ef751938d7d553e3118a26591fa784e97531cdb9fac7900b3b"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c55766bedfda4cf87c1d4d19bf91d5dc88a1be3110d5bbfaa8c35ae63e0a8a3"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fedc6e1c99d7db5665ec399302eb36e5a6d2f56ef86db58d147c6596b49e34ad"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/035b4712ab495d6da3c5c3f3ffff23a811be9f9aabb61bb9fcc4edc5a6841bf1"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ffc85550be5c01024ec85b6e237df41461d9ea2c0ec4ffce54e3f1d91564be0f"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b80c5a36e0459c8e6a356c08c392fc5b2c6d383c7bab696bf3e6376dfad36306"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1423253a413a7acaa99690d074dec3879fdef58071b39df227bf26b9561dce16"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/980bb91d46c480b2a80eff667b1e54180aeb1507b0139bcfc9207fcadc43f9c3"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8abac53e4ac8e4651651416b83a01c0a77bdb3ef73a06802797408109fbfa8e5"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0ca0438c65d72d570c8718f46b3be745d3a9e74c8f61a83b8abd421a0dfc3b98"}
{"level":"info","ts":"2026-07-29T02:05:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d65df674ed6012d0680c62f4d31ad21e2a858e219ae0f8e0023dad9ede3ad0bd"}
{"level":"info","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59586","PortSpecifier":{"PortValue":59586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.26:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59586","PortSpecifier":{"PortValue":59586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.26:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290796,"nanos":498893976},"http":{"id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","method":"POST","headers":{":authority":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6350a84e-9995-410e-b493-3bc98053b013","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"]}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6350a84e-9995-410e-b493-3bc98053b013","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.26:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b251dcc2-e13c-43fb-9925-d81fed36d3e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3211eff9-7d45-49f6-b379-060596fa3769","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59590","PortSpecifier":{"PortValue":59590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.26:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3211eff9-7d45-49f6-b379-060596fa3769","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3211eff9-7d45-49f6-b379-060596fa3769","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:59590","PortSpecifier":{"PortValue":59590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.26:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290796,"nanos":546532631},"http":{"id":"3211eff9-7d45-49f6-b379-060596fa3769","method":"POST","headers":{":authority":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LK2HDwzl8d0ExlhD_qENm4l9icE0FFQ1n7sRx4Z4CJELzH2hDEp4bcE8iHn1"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LK2HDwzl8d0ExlhD_qENm4l9icE0FFQ1n7sRx4Z4CJELzH2hDEp4bcE8iHn1\"}"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d2e9125a-3a24-4346-849d-fb094969fb80","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d2e9125a-3a24-4346-849d-fb094969fb80","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3211eff9-7d45-49f6-b379-060596fa3769","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.26:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3211eff9-7d45-49f6-b379-060596fa3769","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d2e9125a-3a24-4346-849d-fb094969fb80","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3211eff9-7d45-49f6-b379-060596fa3769","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:06:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3211eff9-7d45-49f6-b379-060596fa3769","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"error","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:12Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T02:07:13Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}
{"level":"error","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T02:07:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8db57442-622d-4747-9f87-b0241fa43b13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51402","PortSpecifier":{"PortValue":51402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8db57442-622d-4747-9f87-b0241fa43b13","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-74cb2e.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8db57442-622d-4747-9f87-b0241fa43b13","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51402","PortSpecifier":{"PortValue":51402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290851,"nanos":697607363},"http":{"id":"8db57442-622d-4747-9f87-b0241fa43b13","method":"POST","headers":{":authority":"e2e-ipp-a-74cb2e.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8db57442-622d-4747-9f87-b0241fa43b13","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6350a84e-9995-410e-b493-3bc98053b013","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"]}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8db57442-622d-4747-9f87-b0241fa43b13","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bea12cc2d3e"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6c85a4e0-d373-4885-9fce-cd8740908b51"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6350a84e-9995-410e-b493-3bc98053b013","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.60:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-74cb2e.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-74cb2e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8db57442-622d-4747-9f87-b0241fa43b13","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8db57442-622d-4747-9f87-b0241fa43b13","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:07:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8db57442-622d-4747-9f87-b0241fa43b13","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","method":"POST","path":"/ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e/v1/chat/completions","host":"e2e-ipp-a-74cb2e.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.15:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.60:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785290853,"nanos":756987813},"http":{"id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","method":"POST","headers":{":authority":"e2e-ipp-a-74cb2e.apps.4c93ce32-39a7-4bec-939c-9bea12cc2d3e.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vD4TNwG9Ql3k2gqc_NiZMusTn9HiyqF5PMZ41TCQFhRcm0HBbuCu57Bco8k6"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-74cb2e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vD4TNwG9Ql3k2gqc_NiZMusTn9HiyqF5PMZ41TCQFhRcm0HBbuCu57Bco8k6\"}"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-74cb2e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c39c86ca-5e16-4865-b727-f0e4ac690e52","keyName":"e2e-ipp-74cb2e","subscription":"ipp-route-74cb2e-sub","tenant":"e2e-ipp-a-74cb2e","userId":"c39c86ca-5e16-4865-b727-f0e4ac690e52","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-74cb2e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e\",\"requestedSubscription\":\"ipp-route-74cb2e-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-74cb2e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-74cb2e/models/facebook/opt-125m","name":"ipp-route-74cb2e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-74cb2e-sub","namespace":"ai-tenant-e2e-ipp-a-74cb2e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e"}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-74cb2e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-74cb2e-sub"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c39c86ca-5e16-4865-b727-f0e4ac690e52","keyName":"e2e-ipp-74cb2e","selected_subscription":"ipp-route-74cb2e-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e-sub@ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-74cb2e/models/facebook/opt-125m","name":"ipp-route-74cb2e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-74cb2e-sub","namespace":"ai-tenant-e2e-ipp-a-74cb2e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-74cb2e/ipp-route-74cb2e"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T02:07:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6f50d7d-bfc3-4e4b-b41d-6a334904e9bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7a3b062db9629487fd8cd8122570564e9b520e94ff595a84eb0c1cea2d905df"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10a0bb6627982cb124b09f72ac7eaee58a522de1a89e232c07796e1e07f2d392"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/231a3f0f70479bcf0b902ae46482788cebcd99106b1d2b204b24d329ce57aee6"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ccf64be7a2718dd60497725836880a1a8ca07faac5204ea5cb01323fe910a173"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a11d10e2e0c67ffd278f0dc40c5dd7db4a7c45f6119a02b08ec7684157ac2fe"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66bcf9ee440f8ae2eab5cc51bd2950424faebae6ef2aee2aaddb158d4f7e1b41"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7883b529f52aa3b27fd9b237dfe73b3e7b6be69bf20e8b7c189978b2c02f09e7"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd62fd0249d9bd9de0dd9060a981fd812a1a7e670a6f8e79c9f8fd24888bd3ee"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5587921f8323d56f10739add3c3d90bb5bb7faab4ff8b2f0c3a6c5fa8d858f2f"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ec8cc4479d5f9e8361ec58430d72f12074e9505f9cf095a1edbcfefd5362980"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31dfa29cef70b9074f179540e99d398fb5e5faa196ab90471e1f28d24aeebd29"}
{"level":"info","ts":"2026-07-29T02:08:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c343be82ae211c3ad8d46df3190fd8e36ff6c49e752dcf9148f66b5bdc047ef7"}