{"level":"info","ts":"2026-07-05T00:51:55.076Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-05T00:51:55.079Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:51:55.080Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-05T00:51:55.476Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-1a1f49","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-05T00:49:05Z","generation":12,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0551924b-6718-40ac-8c91-51982b9a0f87\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-05T00:51:45Z"}],"name":"kuadrant-e2e-shared-b-1a1f49","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-1a1f49","uid":"0551924b-6718-40ac-8c91-51982b9a0f87"}],"resourceVersion":"55286","uid":"bff656ea-3985-49cc-94b9-938bce7c039a"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ed3063d524792e594f27b15687a316416be8a85174a74e3f345ac113e139b06","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"ca9e81cb8261ef5f47b8cafab0791622dc72a5e899691dff029513541335cdb8","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2ed3063d524792e594f27b15687a316416be8a85174a74e3f345ac113e139b06","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"e32ef110e90855b8b1fa0532336b76e40a483e3daed704a6e9cab53ad4474519","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0979d9eb97363a1dd9913df101120e5bef641fdc040990790dc12d11bff97169","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"4667b29c967d3106127b6b7a724a004413fa011738db81b3182399900ef018da","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0979d9eb97363a1dd9913df101120e5bef641fdc040990790dc12d11bff97169","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"fb74aa97e56d977e8771c0a8627746097a58c8f03287f68189199400aa81c720","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"74fb9a64606e55f93351db5f522831ecd198c5af9537c390096812ba523d40d5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"7ef0139939b45b6658542bcc1b007ad730b5b3475abeaeb816b391afc658c13a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"74fb9a64606e55f93351db5f522831ecd198c5af9537c390096812ba523d40d5","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"7e7cfcfbf9507e7abc8a85105dc2d471503d5e7b609d47ae4a779854dc0942fa","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f01ad870816c86a7c83501140352495d600aa5aea4c8fa1c03d4ad43909dc57d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"83f348c76a32c7213bc4b4daa1fe59927a0e1d77621972f63a4086a262e64e8d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"b3225e4939f50b65e3c6fedf7197d5f3be6b69c6afbb46d39e75f88ea8d9e507","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"f83350c646a28a94c5ab5900609e785875b21fd4930e0c2b8ed1614667c70cfc","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a5b025f272a36e57ff8f8e2ce2f4ce2d4d31b083cef767668d20d30b448e7b9d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"5220746eaccc2aaa80d6dce4b8716ea8831f68aeaf4f6bef117a30a9f9434f75","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"537e36fb86b422e4e1385e96193c209301eb6308ca6faaefac22b404a2f026c0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"5d7809cc9fb4da274a1d6640792acc905a33f0647608ccd1f96c43622bd34303","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0f5fd10c88cd114ef5a399c0d0bbae33669cb6bae2767b2829555b2d42cd48f8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"2acbf7a9ae8e3ededc18d10b69cf7890d74608508890748f22eb1a343784cc6e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e9d625d8e8341a9233b2996049be85a5c05c3c0f049c9c37791796b721ff8fd0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"a7b3d53376bdc23501168b8adec83fb37823eff509281a63c829e8ccbf1246f3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f2e84bac0ad9b9055ac53800f42b896db2f00c07f1e61d274dcee9bdb16a7684","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_auth_iso_dba31e_auth_test_model_1a1f49_tokens__7d1cbb20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-auth-iso-dba31e@ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/auth-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-auth-test-model-1a1f49"]}],"name":"356d6a98ad6bccb77dad4dd1b37d7eafcb4627527a94d0ddd1b7fa2dc16ef829","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-1a1f49"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:51:55.584Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"e16fc8b5-2d92-4e15-a9f9-efe3762390c3","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-1a1f49\" not found"}
{"level":"error","ts":"2026-07-05T00:51:55.698Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-auth-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"28108283-3771-4c92-85ea-722cd8e6f89d","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-auth-test-model-3575e1\" not found"}
{"level":"error","ts":"2026-07-05T00:51:55.805Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-1a1f49","namespace":"openshift-ingress","uid":"d5854d97-a0bc-4d28-884f-53411d7a43d4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:51:55.990Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-1a1f49","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:51:55.997Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"auth-test-model-1a1f49-kserve-route","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"e586117b-9a6b-4ba6-9411-9ed160d8edf9","error":"httproutes.gateway.networking.k8s.io \"auth-test-model-1a1f49-kserve-route\" not found"}
{"level":"error","ts":"2026-07-05T00:51:56.181Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-3575e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:51:59.181Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","Limitador","TokenRateLimitPolicy","Gateway","ConfigMap","HTTPRoute"],"eventTypes":{"delete":4,"update":6}}
{"level":"info","ts":"2026-07-05T00:51:59.191Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:51:59.280Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:51:59.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:51:59.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:51:59.675Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:51:59.675Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:51:59.879Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:51:59.880Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:00.083Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:00.179Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:52:00.376Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:01.589Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:01.976Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:04.177Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","WasmPlugin","ConfigMap","TokenRateLimitPolicy","AuthConfig"],"eventTypes":{"delete":16,"update":6}}
{"level":"info","ts":"2026-07-05T00:52:04.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:04.278Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:04.682Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:04.682Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:04.779Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:04.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:52:04.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:04.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:04.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:05.178Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:06.405Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-05T00:52:06.682Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-3575e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:52:06.780Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:09.089Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":1,"update":7}}
{"level":"info","ts":"2026-07-05T00:52:09.184Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:09.277Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:09.388Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:09.575Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:09.975Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:09.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:10.175Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:10.184Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:10.585Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:52:10.681Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:10.777Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:12.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:12.484Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:14.987Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthConfig","AuthPolicy","WasmPlugin","HTTPRoute","ConfigMap","Limitador"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-05T00:52:15.085Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:15.093Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:15.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:15.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:15.784Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:15.784Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:15.886Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:52:15.886Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:15.886Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:15.886Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:16.284Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:17.614Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:18.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:19.378Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador","AuthPolicy"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-05T00:52:19.388Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:19.678Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:19.876Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:19.876Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:20.075Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:20.080Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:20.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:52:20.176Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:20.182Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:20.182Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:20.576Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:21.902Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:22.587Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:39.076Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-05T00:52:39.875Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:39.879Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:39.983Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:52:40.078Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:40.084Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:40.084Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:40.378Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:42.198Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:42.485Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:45.292Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","Limitador","WasmPlugin","TokenRateLimitPolicy","AuthPolicy","ConfigMap","HTTPRoute"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-05T00:52:45.486Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:45.583Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:45.776Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:45.776Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:46.475Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:46.475Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:46.577Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:46.686Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:46.775Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:46.985Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:52:46.985Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:48.495Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:49.079Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:50.476Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-05T00:52:50.487Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:50.777Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:52:50.976Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:52:50.976Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:51.286Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:51.286Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:51.581Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:51.582Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:51.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:52:51.881Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:51.982Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:53.396Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:54.088Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:57.086Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-07-05T00:52:57.887Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:57.887Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:52:58.075Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:52:58.378Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:52:58.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:52:58.684Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:05.389Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","TokenRateLimitPolicy","WasmPlugin","HTTPRoute","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-05T00:53:05.400Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:05.975Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:05.988Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:05.988Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:06.375Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:06.375Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:06.475Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:06.782Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:06.878Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-05T00:53:06.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:06.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:06.982Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:53:08.190Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"854ac053-083a-4ac8-a7ea-cd49f78e1e0a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:08.588Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"5e53d5cf-50a6-4dda-94df-20d5d2663fa4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:08.609Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:09.178Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:09.290Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":2,"delete":2}}
{"level":"info","ts":"2026-07-05T00:53:10.279Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:10.375Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:10.375Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:10.378Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-05T00:53:10.477Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:10.477Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-05T00:53:10.983Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-1a1f49","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-05T00:49:05Z","generation":16,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0551924b-6718-40ac-8c91-51982b9a0f87\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-05T00:52:59Z"}],"name":"kuadrant-e2e-shared-b-1a1f49","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-1a1f49","uid":"0551924b-6718-40ac-8c91-51982b9a0f87"}],"resourceVersion":"56496","uid":"bff656ea-3985-49cc-94b9-938bce7c039a"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"30447d325586a1f5b375ba29a7b4c20608d766a60f6981b4b0a4d59ef660b588","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"39fae101c275b12be170639da16fbf94995439ceded28f0b8a2285aeb0dd260a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"30447d325586a1f5b375ba29a7b4c20608d766a60f6981b4b0a4d59ef660b588","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"4b9b60f7f4798f11a7a0f35f8837b3ebe8b65ddd367d0e64ed80550dad21dde5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f726ff13e43f2b66e08c5fa9f529bbb9d46e76df372a066f64773f8c3b5a406e","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"2a8f035ace868d097e61cdbf8765a4c49e05531d16e732e8c7baeb003d3bd4db","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f726ff13e43f2b66e08c5fa9f529bbb9d46e76df372a066f64773f8c3b5a406e","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"a45129ae28e44db695f905519f4d1db4244316968bf42969ee50f44366d53afd","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ca727121de8502c36e0b747c1937b017875c9132b2714a6d30fc3e4f5d404c06","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"a649a352f3aecbaffb348f8464a814058fef81be5ac3689c435d885145b816b3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ca727121de8502c36e0b747c1937b017875c9132b2714a6d30fc3e4f5d404c06","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"a78e59dd7fd7ba2fff3842ca22e699b2d832a53ad2d5a16c6b52195c7fc00d16","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"af55507ad5944a0283d6ec242daf04334ba9f37175e0043e947b6f393802ddaa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"3ba76930d49a2f463704246883f3412fcbec2fff0d2eac140bea26cee90a9a10","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"95ef2a455587c7d226dd935107afc72e50b6fa65ceda1b8dcf0d113870cb1381","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"60b4a5484ffe3c6b9a2596c04fd6d9b15ad740e195f772091e7920fcf4f2f61b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"767397fab062c94d04d849f44f37b1c8db21bf0296d6a9233a41578e13d54c02","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"4e867bc79bc147a76553caad0a8e6c2522c4690a370890abd4c8ab58c464209f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8f897f64b995eedc9c474c2f5c6e52808ccf2f5cfc955844c0219bd695c51d0f","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"05ebb82ae83adb508282fa8016181033e38b9e044bc85d744fe45a133516635d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0f5fd10c88cd114ef5a399c0d0bbae33669cb6bae2767b2829555b2d42cd48f8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"2acbf7a9ae8e3ededc18d10b69cf7890d74608508890748f22eb1a343784cc6e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e9d625d8e8341a9233b2996049be85a5c05c3c0f049c9c37791796b721ff8fd0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"a7b3d53376bdc23501168b8adec83fb37823eff509281a63c829e8ccbf1246f3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"edd7ea34b1aca756df829461c131a1745102a95e8a9eb1627fc3a5bd6763bc57","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_1a1f49_e2e_shared_sub_2f8398_sub_test_model_1a1f49_tokens__3ff58a20","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-1a1f49/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-1a1f49/sub-test-model-1a1f49-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-1a1f49/maas-trlp-sub-test-model-1a1f49"]}],"name":"5643e38a287cca7ce5f27daacab4f03af7958067552271eb58d16b21967ced7e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-1a1f49/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-1a1f49"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:11.076Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-3575e1","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-05T00:48:57Z","generation":11,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f0b474f9-8a24-448f-a32e-33715815cb8f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-05T00:52:58Z"}],"name":"kuadrant-e2e-shared-a-3575e1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-3575e1","uid":"f0b474f9-8a24-448f-a32e-33715815cb8f"}],"resourceVersion":"56488","uid":"fb0ce220-cd15-493d-b8b7-12fa0ec945d7"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f0a4f2567c61db8b2a11542cb2807980b937f293064ebc93b431a7c155ae41fa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"453e6fbbc77da53450f45130168a7beca5e5de09bc63ef4828d3a570aeb7c8fc","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f0a4f2567c61db8b2a11542cb2807980b937f293064ebc93b431a7c155ae41fa","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"f26eee17941f91c7b167a684613793431f7f2fc9fb0ddd978730a256874b57d4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a8a773626f680ef28709d247b46a1073e9f42e63f5277f3ea17655f9f01c4853","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"ee412a7afe95312449f13291a48bbecdcda2190fcf66cb4aad2d28ee6a0b81f4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a8a773626f680ef28709d247b46a1073e9f42e63f5277f3ea17655f9f01c4853","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"67e42793afe5bc7f372be4959ea1889dba6f8ce0fc07615794c6cf8ca174630b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"eab74278a2e9040eeb2198e34d8f38aff7fd376f70dbd74fda4ad989b0c8d761","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"27ec2392b6ea77af22413512c21ac654bec589aa9d8e687dd0494b2a4098c234","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"eab74278a2e9040eeb2198e34d8f38aff7fd376f70dbd74fda4ad989b0c8d761","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"08dd835c6163448a8cd3feac2a8ccd2a9d64df41e2069ed84743193aaa2cafba","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"263633b756f14b32585c7ad01dfac19306c2d8983dd1d172cd90aef9fe1eed38","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"76042a4f6866c4dd0681962e43a504f4233a7846bbd9697932b3563e6dff47c1","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"f34bc718a84e93717269ebb511eef24e41b8374d3d6f510cb675cd6e3ba63877","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"d56d50d82d785ea63946ed5d7fefba692888ea1fd5b2e77f958b52da5070be2a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"03a4d1f3d02da0229c01d49970e68b3bb428b94107befbf3c6a0588b9e3c7fb7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"8c7b2b6cdda42f04d8f008c13f335fd08b0dfb9cf327781c241bf702067491c6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9db0cf1289c26971329037f44e0b21b138dbe1f40a662357c29a2a487724ab10","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"de26e6f247852baa08dc832ee320faf3d007ee2da4752a831ddaf8e9eee17c65","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"70369fd3ceadf47376ab06334d5b30a750d9ce1ccd18a12a9ac50d3a3832a71a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"4d1b5705ca662910d83f93a84b5d5932ea06c8d9b17ef80bcd16832d55487717","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"feaa4eed56d6511eeff44bbcc83ce54edd1246eb47821d86a9112808dc8d85f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"963ce47514b4064fcd342be38d797f443caec0387220ef522740ee1f992fe6ac","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7f2540db1bc2fc3f50d7a0afb03ac16a2a95ad6407f3f5eb8cbe319e39c40527","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_3575e1_e2e_shared_sub_2f8398_sub_test_model_3575e1_tokens__577068cc","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-3575e1/e2e-shared-sub-2f8398@ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-3575e1/maas-trlp-sub-test-model-3575e1"]}],"name":"e0d6efcd8b16a6e27931c55742d40a851dee43ce03263bba868985976b6aaad6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-3575e1"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:11.197Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"5e53d5cf-50a6-4dda-94df-20d5d2663fa4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:11.580Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"854ac053-083a-4ac8-a7ea-cd49f78e1e0a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:14.783Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","WasmPlugin","AuthPolicy","Limitador"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-05T00:53:14.794Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:15.076Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:15.277Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:15.277Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:15.681Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:15.685Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:15.775Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:15.775Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:16.083Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:53:16.088Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:16.177Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:17.829Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:18.492Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:21.587Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","Limitador","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"update":6}}
{"level":"info","ts":"2026-07-05T00:53:21.598Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:22.081Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:22.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:22.186Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:22.476Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:22.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:53:22.487Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:22.487Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:22.487Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:22.586Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:53:24.285Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"854ac053-083a-4ac8-a7ea-cd49f78e1e0a","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-3575e1\" not found"}
{"level":"error","ts":"2026-07-05T00:53:24.590Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"5e53d5cf-50a6-4dda-94df-20d5d2663fa4","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-1a1f49\" not found"}
{"level":"info","ts":"2026-07-05T00:53:25.084Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-05T00:53:25.275Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-3575e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:25.375Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-1a1f49","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:25.393Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:29.986Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","Limitador","ConfigMap","Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":4,"update":8}}
{"level":"info","ts":"2026-07-05T00:53:30.075Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:30.177Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:30.481Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:30.481Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:30.886Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:30.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:30.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:31.182Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:31.278Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:31.279Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:53:31.286Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:33.319Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:33.592Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:33.781Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":1}}
{"level":"info","ts":"2026-07-05T00:53:34.675Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:34.684Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:34.684Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:34.783Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:35.079Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:53:35.183Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:53:35.276Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:35.276Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-05T00:53:35.286Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"d641df9823b66727a0dc3880ea8af367891581b2907ee3b220578167d3393550","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["d641df9823b66727a0dc3880ea8af367891581b2907ee3b220578167d3393550"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"d641df9823b66727a0dc3880ea8af367891581b2907ee3b220578167d3393550\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.297Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"5e195945e28801db67446e75e14a6c5cd2da22590a1f5c4f17f23c8631b375ab","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["5e195945e28801db67446e75e14a6c5cd2da22590a1f5c4f17f23c8631b375ab"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"5e195945e28801db67446e75e14a6c5cd2da22590a1f5c4f17f23c8631b375ab\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.375Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"9c64ac83ef070bf631381c6d413774716b9aa97a299d403df0d8f81ce86b4ecc","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["9c64ac83ef070bf631381c6d413774716b9aa97a299d403df0d8f81ce86b4ecc"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"9c64ac83ef070bf631381c6d413774716b9aa97a299d403df0d8f81ce86b4ecc\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.386Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-3","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-3"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"22ad1029e5d4c71b79181a8ed185dee7a589ad4b4adcb722974e54e879570cc0","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["22ad1029e5d4c71b79181a8ed185dee7a589ad4b4adcb722974e54e879570cc0"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"22ad1029e5d4c71b79181a8ed185dee7a589ad4b4adcb722974e54e879570cc0\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.396Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"4c834075c2b998e6e17d3e69ea97b369f066cac3f19f5e12bfb191e9c13700fe","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["4c834075c2b998e6e17d3e69ea97b369f066cac3f19f5e12bfb191e9c13700fe"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"4c834075c2b998e6e17d3e69ea97b369f066cac3f19f5e12bfb191e9c13700fe\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.399Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-3575e1","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-05T00:48:57Z","generation":14,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"f0b474f9-8a24-448f-a32e-33715815cb8f\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-05T00:53:23Z"}],"name":"kuadrant-e2e-shared-a-3575e1","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-3575e1","uid":"f0b474f9-8a24-448f-a32e-33715815cb8f"}],"resourceVersion":"56901","uid":"fb0ce220-cd15-493d-b8b7-12fa0ec945d7"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4c834075c2b998e6e17d3e69ea97b369f066cac3f19f5e12bfb191e9c13700fe","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"dad0629363882d70d689145182985637e1b46c1be00efdc78c7956f4263a4ee9","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"4c834075c2b998e6e17d3e69ea97b369f066cac3f19f5e12bfb191e9c13700fe","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"fc8f0c2d422728226e34517d9d7ad25dc9a13ff70d0ad5a71e4d93549c074339","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d641df9823b66727a0dc3880ea8af367891581b2907ee3b220578167d3393550","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"1318f151d9f37985679ceba3e36338697bd1ea90c4e6bb246a977134fd708ab0","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"d641df9823b66727a0dc3880ea8af367891581b2907ee3b220578167d3393550","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"0de1f1ff16828a968544b874f9cfa1d99edf0ed38140737839b7d6e75c136fca","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5e195945e28801db67446e75e14a6c5cd2da22590a1f5c4f17f23c8631b375ab","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"8e6cfbace957c9b9113e20ae54f9c1fb3f7ba93dc8978e1c72b1cce7fedd01d3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5e195945e28801db67446e75e14a6c5cd2da22590a1f5c4f17f23c8631b375ab","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"0ea9e2be8055239dfb1a5e2a879c7db64d4cc99ddaa966fc7ce472f13745d872","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"22ad1029e5d4c71b79181a8ed185dee7a589ad4b4adcb722974e54e879570cc0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"79d6f238a53d844f3de19481ba3689d35f9280e11200a5564061ab9a8f6b97a4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"b0b78c2bf8935359f75e352263e08827a0fed7d24725a49078b975147080fce8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"b1702e12ec276f2b9a1c3eeec6ec12dd012706c20cb755c9d42524413f7c16ed","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"62886044dc87cc0e5e1dbef44c431f798e47fe29b1b20d93a9953618fb2b7c5a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"8b52d045e8381769883010c576dc27e482f2bcdb9bc661f891ceb813c37f91c5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9c64ac83ef070bf631381c6d413774716b9aa97a299d403df0d8f81ce86b4ecc","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"29b672d33bb237a52c9cc3e6c66ff8dbcf397e21a1a1d460e9d6a398f7e16697","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"70369fd3ceadf47376ab06334d5b30a750d9ce1ccd18a12a9ac50d3a3832a71a","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"4d1b5705ca662910d83f93a84b5d5932ea06c8d9b17ef80bcd16832d55487717","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"feaa4eed56d6511eeff44bbcc83ce54edd1246eb47821d86a9112808dc8d85f3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-3575e1-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"963ce47514b4064fcd342be38d797f443caec0387220ef522740ee1f992fe6ac","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"465645752f40fdd24de69f217e9d554480d2e66001bb1a9d35b34010a8cc3264","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-3575e1-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__f8ab1870","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-3575e1"]}],"name":"ae0446aea99eb9a7119c53ea58db3af17c7103ee9224170bc69bd4a4950439f2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-3575e1/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-3575e1"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:35.475Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"62886044dc87cc0e5e1dbef44c431f798e47fe29b1b20d93a9953618fb2b7c5a","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["62886044dc87cc0e5e1dbef44c431f798e47fe29b1b20d93a9953618fb2b7c5a"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"62886044dc87cc0e5e1dbef44c431f798e47fe29b1b20d93a9953618fb2b7c5a\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.485Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-1a1f49","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-05T00:49:05Z","generation":19,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"0551924b-6718-40ac-8c91-51982b9a0f87\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-05T00:53:23Z"}],"name":"kuadrant-e2e-shared-b-1a1f49","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-1a1f49","uid":"0551924b-6718-40ac-8c91-51982b9a0f87"}],"resourceVersion":"56895","uid":"bff656ea-3985-49cc-94b9-938bce7c039a"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0f5fd10c88cd114ef5a399c0d0bbae33669cb6bae2767b2829555b2d42cd48f8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"2acbf7a9ae8e3ededc18d10b69cf7890d74608508890748f22eb1a343784cc6e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e9d625d8e8341a9233b2996049be85a5c05c3c0f049c9c37791796b721ff8fd0","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-1a1f49-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__5be9483f","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-1a1f49-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-1a1f49"]}],"name":"a7b3d53376bdc23501168b8adec83fb37823eff509281a63c829e8ccbf1246f3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-1a1f49"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:35.486Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"465645752f40fdd24de69f217e9d554480d2e66001bb1a9d35b34010a8cc3264","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["465645752f40fdd24de69f217e9d554480d2e66001bb1a9d35b34010a8cc3264"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"465645752f40fdd24de69f217e9d554480d2e66001bb1a9d35b34010a8cc3264\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.497Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-3575e1/rate-test-model-3575e1-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"b0b78c2bf8935359f75e352263e08827a0fed7d24725a49078b975147080fce8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3575e1/sub-test-model-3575e1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["b0b78c2bf8935359f75e352263e08827a0fed7d24725a49078b975147080fce8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-3575e1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"b0b78c2bf8935359f75e352263e08827a0fed7d24725a49078b975147080fce8\" already exists"}
{"level":"error","ts":"2026-07-05T00:53:35.575Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ca727121de8502c36e0b747c1937b017875c9132b2714a6d30fc3e4f5d404c06","error":"authconfigs.authorino.kuadrant.io \"ca727121de8502c36e0b747c1937b017875c9132b2714a6d30fc3e4f5d404c06\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.577Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/eab74278a2e9040eeb2198e34d8f38aff7fd376f70dbd74fda4ad989b0c8d761","error":"authconfigs.authorino.kuadrant.io \"eab74278a2e9040eeb2198e34d8f38aff7fd376f70dbd74fda4ad989b0c8d761\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.579Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/767397fab062c94d04d849f44f37b1c8db21bf0296d6a9233a41578e13d54c02","error":"authconfigs.authorino.kuadrant.io \"767397fab062c94d04d849f44f37b1c8db21bf0296d6a9233a41578e13d54c02\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.580Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/8f897f64b995eedc9c474c2f5c6e52808ccf2f5cfc955844c0219bd695c51d0f","error":"authconfigs.authorino.kuadrant.io \"8f897f64b995eedc9c474c2f5c6e52808ccf2f5cfc955844c0219bd695c51d0f\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.582Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f34bc718a84e93717269ebb511eef24e41b8374d3d6f510cb675cd6e3ba63877","error":"authconfigs.authorino.kuadrant.io \"f34bc718a84e93717269ebb511eef24e41b8374d3d6f510cb675cd6e3ba63877\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.583Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f0a4f2567c61db8b2a11542cb2807980b937f293064ebc93b431a7c155ae41fa","error":"authconfigs.authorino.kuadrant.io \"f0a4f2567c61db8b2a11542cb2807980b937f293064ebc93b431a7c155ae41fa\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.585Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/263633b756f14b32585c7ad01dfac19306c2d8983dd1d172cd90aef9fe1eed38","error":"authconfigs.authorino.kuadrant.io \"263633b756f14b32585c7ad01dfac19306c2d8983dd1d172cd90aef9fe1eed38\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.586Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/30447d325586a1f5b375ba29a7b4c20608d766a60f6981b4b0a4d59ef660b588","error":"authconfigs.authorino.kuadrant.io \"30447d325586a1f5b375ba29a7b4c20608d766a60f6981b4b0a4d59ef660b588\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.588Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/95ef2a455587c7d226dd935107afc72e50b6fa65ceda1b8dcf0d113870cb1381","error":"authconfigs.authorino.kuadrant.io \"95ef2a455587c7d226dd935107afc72e50b6fa65ceda1b8dcf0d113870cb1381\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.589Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af55507ad5944a0283d6ec242daf04334ba9f37175e0043e947b6f393802ddaa","error":"authconfigs.authorino.kuadrant.io \"af55507ad5944a0283d6ec242daf04334ba9f37175e0043e947b6f393802ddaa\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.591Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a8a773626f680ef28709d247b46a1073e9f42e63f5277f3ea17655f9f01c4853","error":"authconfigs.authorino.kuadrant.io \"a8a773626f680ef28709d247b46a1073e9f42e63f5277f3ea17655f9f01c4853\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.592Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/9db0cf1289c26971329037f44e0b21b138dbe1f40a662357c29a2a487724ab10","error":"authconfigs.authorino.kuadrant.io \"9db0cf1289c26971329037f44e0b21b138dbe1f40a662357c29a2a487724ab10\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.593Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7f2540db1bc2fc3f50d7a0afb03ac16a2a95ad6407f3f5eb8cbe319e39c40527","error":"authconfigs.authorino.kuadrant.io \"7f2540db1bc2fc3f50d7a0afb03ac16a2a95ad6407f3f5eb8cbe319e39c40527\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.595Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/edd7ea34b1aca756df829461c131a1745102a95e8a9eb1627fc3a5bd6763bc57","error":"authconfigs.authorino.kuadrant.io \"edd7ea34b1aca756df829461c131a1745102a95e8a9eb1627fc3a5bd6763bc57\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.596Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/f726ff13e43f2b66e08c5fa9f529bbb9d46e76df372a066f64773f8c3b5a406e","error":"authconfigs.authorino.kuadrant.io \"f726ff13e43f2b66e08c5fa9f529bbb9d46e76df372a066f64773f8c3b5a406e\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.598Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/03a4d1f3d02da0229c01d49970e68b3bb428b94107befbf3c6a0588b9e3c7fb7","error":"authconfigs.authorino.kuadrant.io \"03a4d1f3d02da0229c01d49970e68b3bb428b94107befbf3c6a0588b9e3c7fb7\" not found"}
{"level":"error","ts":"2026-07-05T00:53:35.780Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"7ca964e7-3405-4ffc-b020-1719b3ae48be","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:35.987Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-3575e1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-3575e1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:36.385Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-3575e1","namespace":"openshift-ingress","uid":"3d468e23-442f-4fca-a977-be5d0713b27e","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:36.479Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"18a21886-247e-4101-861a-d1b8a2cbc102","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:53:36.490Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-1a1f49","namespace":"openshift-ingress","uid":"d5854d97-a0bc-4d28-884f-53411d7a43d4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:36.494Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-05T00:53:36.676Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"rate-test-model-3575e1-kserve-route","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"34583713-5f3f-4367-ba76-05975e7f9438","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"rate-test-model-3575e1-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:53:36.982Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:39.589Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","AuthConfig","WasmPlugin","Limitador","HTTPRoute","ConfigMap"],"eventTypes":{"create":8,"delete":16,"update":10}}
{"level":"info","ts":"2026-07-05T00:53:39.599Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:40.177Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:40.282Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:40.282Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:40.375Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:40.382Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:40.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:53:40.384Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:40.575Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:40.575Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:41.077Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:42.325Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:42.587Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:44.083Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-05T00:53:44.093Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:44.383Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:53:44.576Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:53:44.576Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:44.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:44.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:45.075Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:45.187Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:45.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:53:45.381Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:45.775Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:53:47.388Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:53:47.693Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:53:59.586Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-05T00:54:00.680Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:00.780Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:00.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:00.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:01.083Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:01.087Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:01.178Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:02.907Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:03.477Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:06.289Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","TokenRateLimitPolicy","AuthPolicy","AuthConfig","ConfigMap","WasmPlugin","HTTPRoute"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-05T00:54:06.376Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:06.387Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:06.576Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:06.576Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:07.275Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:07.275Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:07.375Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:07.386Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:54:07.386Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:07.476Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:07.484Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:09.280Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:10.178Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:11.576Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-05T00:54:11.587Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:11.784Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:11.976Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:11.976Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:12.475Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:12.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:54:12.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:12.878Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:12.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:12.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:13.186Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:54:14.186Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-3575e1-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-3575e1-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:54:14.489Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-1a1f49-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-1a1f49-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:54:14.616Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:15.476Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:18.481Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","AuthPolicy"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-07-05T00:54:19.375Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:19.378Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:19.386Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:19.386Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:19.386Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:19.876Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:25.282Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","ConfigMap","TokenRateLimitPolicy","WasmPlugin","Limitador"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-05T00:54:25.293Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:25.383Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:25.676Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:25.676Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:26.175Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:26.175Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:26.275Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:26.477Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:26.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:54:26.480Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:26.580Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:54:28.183Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"c1864ae2-53c6-404a-a8b9-0bcda01cd138","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-1a1f49\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/ai-tenant-e2e-shared-b-1a1f49/maas-trlp-rate-test-model-1a1f49, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: c1864ae2-53c6-404a-a8b9-0bcda01cd138, UID in object meta: bc4ff4c0-92df-4773-9d7b-2745233b64f2"}
{"level":"error","ts":"2026-07-05T00:54:28.385Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"9010b18f-87d6-428b-89c2-6a357c2d9b1a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-3575e1\": StorageError: invalid object, Code: 4, Key: /kubernetes.io/kuadrant.io/tokenratelimitpolicies/ai-tenant-e2e-shared-a-3575e1/maas-trlp-rate-test-model-3575e1, ResourceVersion: 0, AdditionalErrorMsg: Precondition failed: UID in precondition: 9010b18f-87d6-428b-89c2-6a357c2d9b1a, UID in object meta: 653598b2-00e6-4b30-bd6c-2d85b515e551"}
{"level":"info","ts":"2026-07-05T00:54:28.385Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:28.980Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:31.878Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"create":2,"delete":2,"update":6}}
{"level":"info","ts":"2026-07-05T00:54:31.889Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:31.977Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:32.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:32.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:32.689Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:32.689Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:32.689Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:32.875Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:33.286Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:33.481Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:33.482Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:35.080Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:35.394Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:38.380Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador","WasmPlugin"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-05T00:54:38.391Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:38.785Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:38.876Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:38.876Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:39.183Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:39.183Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:39.275Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:39.580Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:39.682Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:54:39.682Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-05T00:54:40.995Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-1a1f49","namespace":"ai-tenant-e2e-shared-b-1a1f49","uid":"bc4ff4c0-92df-4773-9d7b-2745233b64f2","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-1a1f49\" not found"}
{"level":"error","ts":"2026-07-05T00:54:41.478Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-3575e1","namespace":"ai-tenant-e2e-shared-a-3575e1","uid":"653598b2-00e6-4b30-bd6c-2d85b515e551","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-3575e1\" not found"}
{"level":"info","ts":"2026-07-05T00:54:41.478Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-05T00:54:41.683Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-1a1f49","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:54:41.885Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-3575e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:54:41.981Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:44.782Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","ConfigMap","Limitador","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":4,"update":6}}
{"level":"info","ts":"2026-07-05T00:54:44.793Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:45.084Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:45.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:45.276Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:45.575Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:45.584Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:45.681Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:45.776Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:45.785Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:45.785Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:46.186Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:47.410Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-05T00:54:47.685Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-a-3575e1","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-a-3575e1\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:54:47.786Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:50.178Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","WasmPlugin","Gateway","ConfigMap","AuthConfig","HTTPRoute"],"eventTypes":{"delete":17,"update":9}}
{"level":"info","ts":"2026-07-05T00:54:50.188Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:50.281Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:50.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:50.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:50.775Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:50.780Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:50.780Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:50.780Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:50.981Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:51.081Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:54:51.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:54:51.082Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:52.076Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:52.284Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:54.590Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy","AuthConfig","EnvoyFilter","WasmPlugin"],"eventTypes":{"delete":5,"update":4}}
{"level":"info","ts":"2026-07-05T00:54:54.600Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:54.884Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:55.076Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:55.076Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:55.382Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:55.476Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:55.476Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:55.575Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:55.582Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:54:55.783Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:55.876Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:56.790Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:56.990Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:58.288Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","ConfigMap"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-07-05T00:54:58.479Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:58.577Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:54:58.677Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:54:58.677Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:58.786Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:58.986Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:54:58.986Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:54:59.077Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:54:59.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:54:59.780Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:01.976Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","Gateway","ConfigMap","AuthPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":16}}
{"level":"info","ts":"2026-07-05T00:55:02.175Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:02.279Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:55:02.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:55:02.476Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:02.587Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:02.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:02.875Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:03.078Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:03.279Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-05T00:55:03.280Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:03.286Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:03.838Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:04.185Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:07.184Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","ConfigMap","Limitador","EnvoyFilter","WasmPlugin","AuthConfig"],"eventTypes":{"delete":5,"update":17}}
{"level":"info","ts":"2026-07-05T00:55:07.193Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:07.782Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:55:07.880Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:55:07.880Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:07.887Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:07.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:07.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:07.983Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:07.988Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:55:07.988Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:08.182Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:08.791Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:09.085Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:09.187Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway"],"eventTypes":{"delete":2}}
{"level":"info","ts":"2026-07-05T00:55:09.887Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:09.975Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:10.075Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:10.075Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:10.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:55:10.277Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:10.383Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-05T00:55:10.888Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"7ca964e7-3405-4ffc-b020-1719b3ae48be","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:55:10.979Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"18a21886-247e-4101-861a-d1b8a2cbc102","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-05T00:55:10.995Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-1a1f49","namespace":"openshift-ingress","uid":"d5854d97-a0bc-4d28-884f-53411d7a43d4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-1a1f49\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-05T00:55:11.020Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:11.280Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:12.390Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-05T00:55:12.399Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:12.686Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-05T00:55:12.776Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-05T00:55:12.776Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:12.882Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:12.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:12.975Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:12.978Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-05T00:55:12.978Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-05T00:55:12.987Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-05T00:55:13.590Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-05T00:55:13.691Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}