{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9dbac25ac28e1855c977f8fba3fc87b6a7f188210cd71b65ed2e9814bd68aa9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99136a902ae993f24f0d322500658329b34f1356864fbcd72c8750634a25fb03","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b837b87c65b40692e2bd654351514d4130059602f464fc584e6c2d4a01bae13"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b57bdf28c8e9e37320bf1393aaf57c4de0864d418db771e1021c43eb57b5eaa"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7d0629c97fd1f2a252ad3218a6d05858a22fd632b48c06b244ced45553912a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b837b87c65b40692e2bd654351514d4130059602f464fc584e6c2d4a01bae13","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b57bdf28c8e9e37320bf1393aaf57c4de0864d418db771e1021c43eb57b5eaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:36:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134"}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:36:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"027d6122-ae6f-4083-a064-28d17da38333","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33180","PortSpecifier":{"PortValue":33180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"027d6122-ae6f-4083-a064-28d17da38333","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"027d6122-ae6f-4083-a064-28d17da38333","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33180","PortSpecifier":{"PortValue":33180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785342993,"nanos":126566098},"http":{"id":"027d6122-ae6f-4083-a064-28d17da38333","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"027d6122-ae6f-4083-a064-28d17da38333","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"027d6122-ae6f-4083-a064-28d17da38333","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0b837b87c65b40692e2bd654351514d4130059602f464fc584e6c2d4a01bae13"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.62:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"027d6122-ae6f-4083-a064-28d17da38333","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"027d6122-ae6f-4083-a064-28d17da38333","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"027d6122-ae6f-4083-a064-28d17da38333","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44908","PortSpecifier":{"PortValue":44908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"81c7b725-b1fd-4761-ad16-e60589f12264","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:44908","PortSpecifier":{"PortValue":44908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785342993,"nanos":171253562},"http":{"id":"81c7b725-b1fd-4761-ad16-e60589f12264","method":"POST","headers":{":authority":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"92068c7c38747b44b4ec045ee6c6fbfb961eee4b9b2d0b5f3b6bcbb08dc2476d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-eccd34/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"81c7b725-b1fd-4761-ad16-e60589f12264","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33196","PortSpecifier":{"PortValue":33196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33196","PortSpecifier":{"PortValue":33196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785342993,"nanos":213697975},"http":{"id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln\"}"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","subscription":"e2e-rate-iso-a-72bd74","tenant":"e2e-shared-a-81ab8b","userId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-72bd74\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-72bd74"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","selected_subscription":"e2e-rate-iso-a-72bd74","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-72bd74@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d257a9d-01dc-42fc-9baf-176dc1986e4c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33202","PortSpecifier":{"PortValue":33202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33202","PortSpecifier":{"PortValue":33202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785342994,"nanos":302545785},"http":{"id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln\"}"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","subscription":"e2e-rate-iso-a-72bd74","tenant":"e2e-shared-a-81ab8b","userId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-72bd74\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-72bd74"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","selected_subscription":"e2e-rate-iso-a-72bd74","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-72bd74@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6f15d27-00bc-40ee-bc4c-db489b03f81b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33210","PortSpecifier":{"PortValue":33210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:33210","PortSpecifier":{"PortValue":33210}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785342995,"nanos":347837878},"http":{"id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6uIDV0N3Ook8yBiG_GsdxSYj3P03rkEW00eupCqN2zBi25lqXQC3dENK1xln\"}"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","subscription":"e2e-rate-iso-a-72bd74","tenant":"e2e-shared-a-81ab8b","userId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-72bd74\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-72bd74"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9ca44902-e15d-4e6c-ae8f-6e606e2ab481","keyName":"e2e-rate-a-72bd74","selected_subscription":"e2e-rate-iso-a-72bd74","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-72bd74@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-72bd74","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4adcb4f1-90f2-4627-9555-ed6e7f394ebb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5783962-6348-40fc-babd-b315b8b1715c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59890","PortSpecifier":{"PortValue":59890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5783962-6348-40fc-babd-b315b8b1715c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5783962-6348-40fc-babd-b315b8b1715c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59890","PortSpecifier":{"PortValue":59890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343013,"nanos":666202316},"http":{"id":"e5783962-6348-40fc-babd-b315b8b1715c","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e5783962-6348-40fc-babd-b315b8b1715c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5783962-6348-40fc-babd-b315b8b1715c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0b837b87c65b40692e2bd654351514d4130059602f464fc584e6c2d4a01bae13"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.62:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5783962-6348-40fc-babd-b315b8b1715c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5783962-6348-40fc-babd-b315b8b1715c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5783962-6348-40fc-babd-b315b8b1715c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:58530","PortSpecifier":{"PortValue":58530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cde2af04-0626-4728-a205-a8c0e6e6a740","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:58530","PortSpecifier":{"PortValue":58530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343013,"nanos":697872653},"http":{"id":"cde2af04-0626-4728-a205-a8c0e6e6a740","method":"POST","headers":{":authority":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"92068c7c38747b44b4ec045ee6c6fbfb961eee4b9b2d0b5f3b6bcbb08dc2476d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-eccd34/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cde2af04-0626-4728-a205-a8c0e6e6a740","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59894","PortSpecifier":{"PortValue":59894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59894","PortSpecifier":{"PortValue":59894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343013,"nanos":736119022},"http":{"id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd\"}"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","subscription":"e2e-rate-iso-a-a948f9","tenant":"e2e-shared-a-81ab8b","userId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-a948f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a948f9"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","selected_subscription":"e2e-rate-iso-a-a948f9","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-a948f9@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbe5119b-dbbe-4564-acb8-39e4aeab0746","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59896","PortSpecifier":{"PortValue":59896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e2257073-ab96-4f44-8c72-31d94cc78b07","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59896","PortSpecifier":{"PortValue":59896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343014,"nanos":775084075},"http":{"id":"e2257073-ab96-4f44-8c72-31d94cc78b07","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd\"}"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","subscription":"e2e-rate-iso-a-a948f9","tenant":"e2e-shared-a-81ab8b","userId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-a948f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a948f9"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","selected_subscription":"e2e-rate-iso-a-a948f9","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-a948f9@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2257073-ab96-4f44-8c72-31d94cc78b07","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59912","PortSpecifier":{"PortValue":59912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","method":"POST","path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions","host":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:59912","PortSpecifier":{"PortValue":59912}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.62:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343015,"nanos":816848631},"http":{"id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","method":"POST","headers":{":authority":"e2e-shared-a-81ab8b.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-aLn8g0rQnDCTdh3O_L5kLgGMtQk9PuXLByXamATRnKX8W2BB1ZIRrFwj52Nd\"}"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","subscription":"e2e-rate-iso-a-a948f9","tenant":"e2e-shared-a-81ab8b","userId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\",\"requestedSubscription\":\"e2e-rate-iso-a-a948f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-81ab8b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a948f9"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"873bd5e5-28bb-47d4-8f44-4ac4bf15fc37","keyName":"e2e-rate-a-a948f9","selected_subscription":"e2e-rate-iso-a-a948f9","selected_subscription_key":"ai-tenant-e2e-shared-a-81ab8b/e2e-rate-iso-a-a948f9@ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-81ab8b/models/facebook/opt-125m","name":"rate-test-model-81ab8b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a948f9","namespace":"ai-tenant-e2e-shared-a-81ab8b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-81ab8b/rate-test-model-81ab8b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bababbbf-c0b8-45fc-a0d8-9e1739549081","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:58546","PortSpecifier":{"PortValue":58546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a016b383-8d57-49c9-8783-3af4e972a18a","method":"POST","path":"/ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34/v1/completions","host":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:58546","PortSpecifier":{"PortValue":58546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343015,"nanos":850890176},"http":{"id":"a016b383-8d57-49c9-8783-3af4e972a18a","method":"POST","headers":{":authority":"e2e-shared-b-eccd34.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hEs7O0LlBoH4wIG2_7BH76MnUagaDOQzO8pTJukom7a9Ra08BspR1crgKQmT"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-eccd34.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hEs7O0LlBoH4wIG2_7BH76MnUagaDOQzO8pTJukom7a9Ra08BspR1crgKQmT\"}"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-eccd34.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0bf8bc8c-49cb-41f0-8e59-221c1ee926a9","keyName":"e2e-rate-b-a948f9","subscription":"e2e-rate-iso-b-a948f9","tenant":"e2e-shared-b-eccd34","userId":"0bf8bc8c-49cb-41f0-8e59-221c1ee926a9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-eccd34.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34\",\"requestedSubscription\":\"e2e-rate-iso-b-a948f9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-eccd34.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-eccd34/models/facebook/opt-125m","name":"rate-test-model-eccd34","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a948f9","namespace":"ai-tenant-e2e-shared-b-eccd34","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34"}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-eccd34/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-a948f9"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0bf8bc8c-49cb-41f0-8e59-221c1ee926a9","keyName":"e2e-rate-b-a948f9","selected_subscription":"e2e-rate-iso-b-a948f9","selected_subscription_key":"ai-tenant-e2e-shared-b-eccd34/e2e-rate-iso-b-a948f9@ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-eccd34/models/facebook/opt-125m","name":"rate-test-model-eccd34","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a948f9","namespace":"ai-tenant-e2e-shared-b-eccd34","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-eccd34/rate-test-model-eccd34"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:36:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a016b383-8d57-49c9-8783-3af4e972a18a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:36:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7d0629c97fd1f2a252ad3218a6d05858a22fd632b48c06b244ced45553912a6"}
{"level":"info","ts":"2026-07-29T16:36:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0b837b87c65b40692e2bd654351514d4130059602f464fc584e6c2d4a01bae13"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45ed02579bf8269ddf32908c85ecf4c3d93e03fb03e6bc6b50408ff73794c3c1"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b04c8160d4a361b275ce038b8dc1f04b53b582e01bf612bc68db08852deb836b"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0471a203c7a937c4384e32a1bd8bec50fcc6bbb7c31119ba5d1fa6e634027a5f"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/27bfaa41fbe50f26a640342a2ef27be61575757b311d1b1c70368a7f956d4424"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/910aa2a399e34a8216df0047396979314f26ebdcd0b0a06a43afb6a5538ea221"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b46cce8cde8ce75d861073bdf15e71eaade6a68723efed2e748b27dbeda89d1"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3578021469527f6a29e1337ebc783d7b9173356e49aa0e1bb75d65531ab0fbd"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99136a902ae993f24f0d322500658329b34f1356864fbcd72c8750634a25fb03"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5dd62c129541b049d62d23491e14d37b8e31233e9bd4b11eab86fd52317897ca"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bacbd5a19557737dc0520a0504474bcff0879ced10667d2a23443cd9c42c9bdf"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef9773c4a74a483c439b0d327be7e07c63b698509269aaba9068390d841c33da"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9dbac25ac28e1855c977f8fba3fc87b6a7f188210cd71b65ed2e9814bd68aa9b"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e4d0b9f2f1d7166d9044302e61e8bc5bf85225a6520899568e3782b6834a956"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dec9db6e9043aa6e6551c8edb04b09b01347bfa5c0c836a9843cc60f64057e0d"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/92068c7c38747b44b4ec045ee6c6fbfb961eee4b9b2d0b5f3b6bcbb08dc2476d"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/423d18a34d2d3e8b173411602f12a43f3bad5470e773992c71117af11d0ae334"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0de64f65bd91a74da252a6450c71e4a1d64018cc02cff0e9cb68e16687ebc279"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99491183848697343f4d1a993343890bb94238e479011066aea083eeada3833c"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c2b09ef7fc29a2ce727f3481e5652f294a95dae492755bbd4bb98766012e134"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55ef9dcf940591f3b3d5db20b25e8f157c2dbe67208b162d1e636fa3500cd0df"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d803967591fe28bc6ecde9f11ce6a9ab9f541eed09ae5d7a5c6b6fa672665c8a"}
{"level":"info","ts":"2026-07-29T16:37:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b57bdf28c8e9e37320bf1393aaf57c4de0864d418db771e1021c43eb57b5eaa"}
{"level":"info","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56820","PortSpecifier":{"PortValue":56820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56820","PortSpecifier":{"PortValue":56820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343105,"nanos":545373500},"http":{"id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","method":"POST","headers":{":authority":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97fa8e6b-9075-9d55-8c18-e84aac7c519f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56834","PortSpecifier":{"PortValue":56834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56834","PortSpecifier":{"PortValue":56834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343105,"nanos":596694094},"http":{"id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","method":"POST","headers":{":authority":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18J2i95O2zFxhN2if_pXn6qjhPUuruyUvR4SerO2vUM3CxIHh9CHD63irQPMO"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18J2i95O2zFxhN2if_pXn6qjhPUuruyUvR4SerO2vUM3CxIHh9CHD63irQPMO\"}"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1afe2d2f-b3bc-4996-9b71-8e1e8e9f05a1","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"1afe2d2f-b3bc-4996-9b71-8e1e8e9f05a1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1afe2d2f-b3bc-4996-9b71-8e1e8e9f05a1","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:38:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"acc6077e-2d2b-49f8-bd01-8d5383f593ec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"error","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"error","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"debug","ts":"2026-07-29T16:38:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-29T16:38:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d"}
{"level":"debug","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc"}
{"level":"info","ts":"2026-07-29T16:38:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"}
{"level":"info","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60400","PortSpecifier":{"PortValue":60400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-777250.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60400","PortSpecifier":{"PortValue":60400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343150,"nanos":566867327},"http":{"id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","method":"POST","headers":{":authority":"e2e-ipp-a-777250.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"204a4080-2589-4dbf-9946-c110f93695bb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"]}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/5e5f17ebaa20"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bebdf9a7-fc3a-4839-9d95-2693b097a2be"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"204a4080-2589-4dbf-9946-c110f93695bb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.69:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-777250.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-777250/ipp-route-777250\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-777250/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:39:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7407fc2e-8aad-4f29-86d2-bd5d815b1ef6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60404","PortSpecifier":{"PortValue":60404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","method":"POST","path":"/ai-tenant-e2e-ipp-a-777250/ipp-route-777250/v1/chat/completions","host":"e2e-ipp-a-777250.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60404","PortSpecifier":{"PortValue":60404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785343152,"nanos":635867810},"http":{"id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","method":"POST","headers":{":authority":"e2e-ipp-a-777250.apps.7c40d7ce-a353-4481-b4ba-5e5f17ebaa20.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-777250/ipp-route-777250/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-4stylgDnfK6gCO8h_fNKttYhfxO8jbKtJVE0dJguJfSBFBvRFWW2qtwmWjX8"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-777250.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-4stylgDnfK6gCO8h_fNKttYhfxO8jbKtJVE0dJguJfSBFBvRFWW2qtwmWjX8\"}"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-777250.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd63ee14-4a53-440f-b15d-b4936ae749d6","keyName":"e2e-ipp-777250","subscription":"ipp-route-777250-sub","tenant":"e2e-ipp-a-777250","userId":"dd63ee14-4a53-440f-b15d-b4936ae749d6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-777250.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-777250/ipp-route-777250\",\"requestedSubscription\":\"ipp-route-777250-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-777250.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-777250/models/facebook/opt-125m","name":"ipp-route-777250","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-777250-sub","namespace":"ai-tenant-e2e-ipp-a-777250","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-777250/ipp-route-777250"}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-777250/ipp-route-777250\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-777250/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-777250-sub"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd63ee14-4a53-440f-b15d-b4936ae749d6","keyName":"e2e-ipp-777250","selected_subscription":"ipp-route-777250-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-777250/ipp-route-777250-sub@ai-tenant-e2e-ipp-a-777250/ipp-route-777250","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-777250/models/facebook/opt-125m","name":"ipp-route-777250","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-777250-sub","namespace":"ai-tenant-e2e-ipp-a-777250","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-777250/ipp-route-777250"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-29T16:39:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c56c32ea-d2fa-44da-a47d-01311a5e6c14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6386c7e4dbdb617463b496fe2549f7d999b890f5d75605ab678dd28ae93b8173"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/413eacf22aa8b82b5521b327df2e69cd8186a378713719dabfd54e4260213c8d"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fb72a4881a7204d598d416d82a04cbd4406734bd8a4de403bcab6291be85a27"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0e65d6d1ab08b19d0ba35a5324ed924fd790f4bdc5407c6677fba919c0506c06"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5105360c259dedefece94f8b9bbb1614889856ee737f310641054782f794eeb9"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2da5bd2eee6b3ffec0413acb415b517cfe293616946fae115dc784358d031e9"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e6df0e00d7768181066acf54f6022cae1683ff6d7abee20520b1b1095d123fcc"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04677faffb9260f79028b400f20e71d198630a40b939d3a7476b77ca7537317a"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e9310d4a99272a451c2df2c1acaf86e223a9bd769ae53e60466e412698e001d"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d6ea5ecce5830027dc6e9a43421bb077455af688da3a10bdd4def93bfc6bb1a"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c57d2d6486f844ebcb1aa787a981972bdd46b880ba56103392bece786ba540d"}
{"level":"info","ts":"2026-07-29T16:40:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef9a9645c748074450ecc63fae04f3a9c41898af44acc14d2ef8b3b8660fb3e5"}