{"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"46c3e64f-ab4d-42e7-bfac-cb4c7232e4bb","keyName":"e2e-rate-a-8c32f1","subscription":"e2e-rate-iso-a-8c32f1","tenant":"e2e-shared-a-addd0c","userId":"46c3e64f-ab4d-42e7-bfac-cb4c7232e4bb","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-8c32f1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c32f1","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c32f1"} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"46c3e64f-ab4d-42e7-bfac-cb4c7232e4bb","keyName":"e2e-rate-a-8c32f1","selected_subscription":"e2e-rate-iso-a-8c32f1","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-8c32f1@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c32f1","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:18:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1033b0e-1bc5-40a9-b18f-b4d08ad899ef","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41318","PortSpecifier":{"PortValue":41318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41318","PortSpecifier":{"PortValue":41318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176342,"nanos":975215868},"http":{"id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"]}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"602d592290475e9739b657d8e2f3ce7679ca4922f3baa2f2a80319ee7cd57189"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.86:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2cd0ab0b-e1fb-4189-be54-67e509d2cf24","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:39722","PortSpecifier":{"PortValue":39722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.89:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-1706dd.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:39722","PortSpecifier":{"PortValue":39722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.89:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176343,"nanos":13228526},"http":{"id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","method":"POST","headers":{":authority":"e2e-shared-b-1706dd.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"]}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"624896c1393584a659a7fc26c0fcbe8e6868982283fc8fe3585fe701ad917e6d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.89:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-1706dd.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1706dd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"485f6579-9352-49f4-a2f0-a9a89cb0c6e8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41322","PortSpecifier":{"PortValue":41322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41322","PortSpecifier":{"PortValue":41322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176343,"nanos":48257637},"http":{"id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"293fd830-4190-4ee0-b0ca-7854e9fa2ae2","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41328","PortSpecifier":{"PortValue":41328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41328","PortSpecifier":{"PortValue":41328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176344,"nanos":83623220},"http":{"id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3795a67b-83e4-47ad-97a2-0933a7ea4ed3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41344","PortSpecifier":{"PortValue":41344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41344","PortSpecifier":{"PortValue":41344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176345,"nanos":117570321},"http":{"id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef8be525-f0ad-45dd-8f84-2f381e01fba8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41350","PortSpecifier":{"PortValue":41350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30c55974-924e-4a92-a00d-8a52372af2b5","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41350","PortSpecifier":{"PortValue":41350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176346,"nanos":152082679},"http":{"id":"30c55974-924e-4a92-a00d-8a52372af2b5","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30c55974-924e-4a92-a00d-8a52372af2b5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41362","PortSpecifier":{"PortValue":41362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41362","PortSpecifier":{"PortValue":41362}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176347,"nanos":203712654},"http":{"id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c36b1fc-4bd6-4667-8730-4379c24f1675","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41378","PortSpecifier":{"PortValue":41378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41378","PortSpecifier":{"PortValue":41378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176348,"nanos":243050590},"http":{"id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6fa4e0f6-79b2-4aaa-a1d5-e969b85b336d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41386","PortSpecifier":{"PortValue":41386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41386","PortSpecifier":{"PortValue":41386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176349,"nanos":276906601},"http":{"id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a8dccc0-f6ff-4344-94fb-9a63565ed5d1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41402","PortSpecifier":{"PortValue":41402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","method":"POST","path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions","host":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:41402","PortSpecifier":{"PortValue":41402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.86:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176350,"nanos":317415155},"http":{"id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","method":"POST","headers":{":authority":"e2e-shared-a-addd0c.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CZtqXU1QWht7aBBJ_G6dap8P1kr7o7grIpTU5FuIp8hUlBqCSBw95c4Zx49r\"}"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","subscription":"e2e-rate-iso-a-21dab9","tenant":"e2e-shared-a-addd0c","userId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\",\"requestedSubscription\":\"e2e-rate-iso-a-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-addd0c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3315d1c5-dbb3-4534-a107-95d6bb578d21","keyName":"e2e-rate-a-21dab9","selected_subscription":"e2e-rate-iso-a-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-a-addd0c/e2e-rate-iso-a-21dab9@ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-addd0c/models/facebook/opt-125m","name":"rate-test-model-addd0c","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-21dab9","namespace":"ai-tenant-e2e-shared-a-addd0c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-addd0c/rate-test-model-addd0c"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5290790a-be0e-4c19-9254-98dc7b2e1dc6","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:39730","PortSpecifier":{"PortValue":39730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.89:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","method":"POST","path":"/ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd/v1/completions","host":"e2e-shared-b-1706dd.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:39730","PortSpecifier":{"PortValue":39730}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.89:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176350,"nanos":351230320},"http":{"id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","method":"POST","headers":{":authority":"e2e-shared-b-1706dd.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-lDD0T6Tbs41Xjr1F_y03euKHcZqoFwHWANL0fBLPJZdQZhLM8W7M7II3Jvbi"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-1706dd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-lDD0T6Tbs41Xjr1F_y03euKHcZqoFwHWANL0fBLPJZdQZhLM8W7M7II3Jvbi\"}"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1706dd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04aa475c-458d-4144-81c0-1a56ee28ef1d","keyName":"e2e-rate-b-21dab9","subscription":"e2e-rate-iso-b-21dab9","tenant":"e2e-shared-b-1706dd","userId":"04aa475c-458d-4144-81c0-1a56ee28ef1d","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-1706dd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd\",\"requestedSubscription\":\"e2e-rate-iso-b-21dab9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-1706dd.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1706dd/models/facebook/opt-125m","name":"rate-test-model-1706dd","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-21dab9","namespace":"ai-tenant-e2e-shared-b-1706dd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd"}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-1706dd/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-21dab9"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"04aa475c-458d-4144-81c0-1a56ee28ef1d","keyName":"e2e-rate-b-21dab9","selected_subscription":"e2e-rate-iso-b-21dab9","selected_subscription_key":"ai-tenant-e2e-shared-b-1706dd/e2e-rate-iso-b-21dab9@ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-1706dd/models/facebook/opt-125m","name":"rate-test-model-1706dd","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-21dab9","namespace":"ai-tenant-e2e-shared-b-1706dd","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-1706dd/rate-test-model-1706dd"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f55f2e4a-5504-4012-82f5-ac9532fefae6","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a91e7eba4bb6cc24cfc7600d2454826283bdafd11849c4464fd31a018e769ce5"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/49d1991f768b7179f72586c322e0387244ad43fe573f2bf22d96d5cf39f5fb02"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2dbc0a7d8bedcfc83391cf8240199ff68a82b020028d2bc47d1b8aa06fb2d60"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a25936c63639e59da14747a58ef515beb97c908c1ec82929406c31db48559ad"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08cf79d043052212d5b9d89f0841df536a3c3c82528bc889f1e4b80160c9346d"} {"level":"info","ts":"2026-07-27T18:19:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/594e9f627f273d9a1ec48cae01ce9a912bc7c8aad0079370eb4f704c4dd4a062"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d79cc6078256c523ed6d99ff06bbdc0ed64d8ab088ca27d72f6f5cfeeb0e6d5"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf4e985b9c2054568c4d3577c0c1449ba5aa50348d1e9131814c2a4bc859fb15"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d76763893b2b34b27dbe5247bd27d94cf22bdd434013a76414aa26425c704a93"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/12add4d24bc8fdb51e65f45c1a62bba7b0f2079e00a0c9d3e1047799e33f9f9d"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/602d592290475e9739b657d8e2f3ce7679ca4922f3baa2f2a80319ee7cd57189"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c9d15171e202b1ad51f2c91331ee19ac8230fdb93532ea55e9a5f85f6748aa2f"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9481aa9e01168fa96061b7829feb52dcb35a87117d0177653ebe91bed117d4e7"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7c507e672607c960a48b62cc5fee190ddb7c72585f4fb7be721fe9c12ca6bff4"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7f81039fa3b30957b27ce58840615068e4cf0079bc64b1a98fca94c4505fd81"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a89334dccd8564f921a3cda819e6b81a9e7a6a5ff3199eda36fc48a26672a54"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2f488b9f4da92411fdf90d8952fbd610d820fc2ef3100c30dbb3906b7776c5b"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/58cdb943d404f57f5a9193401c30cd118bae4530628ff9549ad9b98b550b88c6"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a999c13f9ecc23f10064dd66458c91ab9cddbb73518e65344e1cc8827191a4b"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56b951515904d1a902f62bae7f2c284d0504231b216e37e5951c34d250cdb509"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/43cf9736aa765dd311f2f481fb7a61d5bca3df7df1c243d25457aa5bf89b4a07"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/664341e0742edd9a5b2adaa86e84cfd2a5be13a421bafe8746dd674a12688071"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/624896c1393584a659a7fc26c0fcbe8e6868982283fc8fe3585fe701ad917e6d"} {"level":"info","ts":"2026-07-27T18:19:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f6d4979c0fb655b33c84329f8d29d5aadb960fb574d55461279cf7a22886dc09"} {"level":"info","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:51310","PortSpecifier":{"PortValue":51310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:51310","PortSpecifier":{"PortValue":51310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176417,"nanos":156043912},"http":{"id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","method":"POST","headers":{":authority":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"]}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline","msg":"skipping config","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"reason":"context canceled"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"725d2209-e261-4b2d-9259-1dff9a58ee5d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:51326","PortSpecifier":{"PortValue":51326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:51326","PortSpecifier":{"PortValue":51326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176417,"nanos":235105956},"http":{"id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","method":"POST","headers":{":authority":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4AKkn6Qoeqd3yPh_m7fp3tRpB1PtjZ2gjQSRQDlnOqWnysiSd61px7g8QCS"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4AKkn6Qoeqd3yPh_m7fp3tRpB1PtjZ2gjQSRQDlnOqWnysiSd61px7g8QCS\"}"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ceef88e-a4c1-480d-9ae8-025f12fdf798","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"0ceef88e-a4c1-480d-9ae8-025f12fdf798","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ceef88e-a4c1-480d-9ae8-025f12fdf798","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:20:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcc0c751-12a2-44e0-bb75-f0fb0186d68b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da"} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:49Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T18:20:50Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"} {"level":"info","ts":"2026-07-27T18:20:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"} {"level":"info","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"299eab6e-1c18-422d-a0de-953a2f841626","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59536","PortSpecifier":{"PortValue":59536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.92:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"299eab6e-1c18-422d-a0de-953a2f841626","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-f4a7a7.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"299eab6e-1c18-422d-a0de-953a2f841626","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59536","PortSpecifier":{"PortValue":59536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.92:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176472,"nanos":400860593},"http":{"id":"299eab6e-1c18-422d-a0de-953a2f841626","method":"POST","headers":{":authority":"e2e-ipp-a-f4a7a7.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"299eab6e-1c18-422d-a0de-953a2f841626","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"]}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"299eab6e-1c18-422d-a0de-953a2f841626","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/9bd87213719a"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=a39eaf15-eef0-4ea2-a1fd-7a4b278b058f"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4902d4ab-d0c3-444f-87fe-f1bdc61ba3cc","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.92:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-f4a7a7.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f4a7a7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"299eab6e-1c18-422d-a0de-953a2f841626","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"299eab6e-1c18-422d-a0de-953a2f841626","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:21:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"299eab6e-1c18-422d-a0de-953a2f841626","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59542","PortSpecifier":{"PortValue":59542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.92:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","method":"POST","path":"/ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7/v1/chat/completions","host":"e2e-ipp-a-f4a7a7.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.10:59542","PortSpecifier":{"PortValue":59542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.92:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785176474,"nanos":468407374},"http":{"id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","method":"POST","headers":{":authority":"e2e-ipp-a-f4a7a7.apps.6bf7282c-92d2-41e3-88b4-9bd87213719a.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1lJy8r1s6jJze2vd_jwYvz4OPEHgooRqmvVTL4UbAv9LFp9UwV1TfRn0uRCv"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-f4a7a7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1lJy8r1s6jJze2vd_jwYvz4OPEHgooRqmvVTL4UbAv9LFp9UwV1TfRn0uRCv\"}"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f4a7a7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b685e60d-a915-49fc-a923-c402ddb5f382","keyName":"e2e-ipp-f4a7a7","subscription":"ipp-route-f4a7a7-sub","tenant":"e2e-ipp-a-f4a7a7","userId":"b685e60d-a915-49fc-a923-c402ddb5f382","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-f4a7a7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7\",\"requestedSubscription\":\"ipp-route-f4a7a7-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-f4a7a7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f4a7a7/models/facebook/opt-125m","name":"ipp-route-f4a7a7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f4a7a7-sub","namespace":"ai-tenant-e2e-ipp-a-f4a7a7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7"}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-f4a7a7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-f4a7a7-sub"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b685e60d-a915-49fc-a923-c402ddb5f382","keyName":"e2e-ipp-f4a7a7","selected_subscription":"ipp-route-f4a7a7-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7-sub@ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-f4a7a7/models/facebook/opt-125m","name":"ipp-route-f4a7a7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-f4a7a7-sub","namespace":"ai-tenant-e2e-ipp-a-f4a7a7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-f4a7a7/ipp-route-f4a7a7"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-27T18:21:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98ae3b87-4054-42fa-8e3c-491feb9bad6c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f13ada16beb895ab615a152a83c6216a52247a404d5ce98b00a2ac761be3a825"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85d1b8eb828d5251917d7714bd0d51e8f4d1c84500ae896ebc06dfc0cbcd5bc4"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d78f5e2c16315e74675ddaaaea6f88de06348aaa4b27ebeecddc957663dd4434"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7135d384a3991cb74c105184b3f62af155bb1c57081ecb3efafe204f5bf40ee9"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfe8c58b0e4615640da5be2abf0d77423b1400e707c7dd2768777820555f4ed3"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc850515bdc2bc8d84356c1ef49ae310e720ec3ed939d5beaf8aef4dab4f02a7"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9be4793cc48be3944e0237d5fa1b865cdca288c6d18655ddc52c04d5be51665c"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a4efa376851b7a467590885d6416ff92f08de7d9525c3a94bf0ae8143a5c2f1"} {"level":"info","ts":"2026-07-27T18:22:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ed9964c82385606da20ce824681562550c8cf1aee8571fac2d4a1e1c50ef6d1"} {"level":"info","ts":"2026-07-27T18:22:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e884274bab9a059b90b6ce5f1cfd7057ae0c58b3a99d38b6bfdd62a0200f4d35"} {"level":"info","ts":"2026-07-27T18:22:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cc735d54d43c3c0303b37946088149f0048e08de9d844d3edf33cf93d806d886"} {"level":"info","ts":"2026-07-27T18:22:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60cd6a06522c8e8bd5340c5f79f40c7b4c200f88bfe24b2dc9e8122ca88873da"}