{"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97485d9da420421b57eae0169256de390aaf34c6cb14937cd274b0ed51d26b55","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97485d9da420421b57eae0169256de390aaf34c6cb14937cd274b0ed51d26b55"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b432115016824903abc8fb28a2d5fa8f421efb65b6e79d4aeb5b6a9cb983c281","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b432115016824903abc8fb28a2d5fa8f421efb65b6e79d4aeb5b6a9cb983c281"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dc8b94046522890813f5d297f72716f3aa12ab01382309b4a555429dcd52a87","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dc8b94046522890813f5d297f72716f3aa12ab01382309b4a555429dcd52a87"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e239bb744ad357288d92a917e9a1f5cba67452f6e5b889305fc98da0787d114e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9862f526d1e4e3f7530aa24db9634368eedba0763f04d7e378e3655a362e93c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e239bb744ad357288d92a917e9a1f5cba67452f6e5b889305fc98da0787d114e"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9862f526d1e4e3f7530aa24db9634368eedba0763f04d7e378e3655a362e93c6"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9cd45ae4ed7a231d66fd12262f24f603cbf55f91cdbf4349413572c519d4b72","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9cd45ae4ed7a231d66fd12262f24f603cbf55f91cdbf4349413572c519d4b72"} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f00486348c0a47f5930d481db6e8e810d703ab2a2ef3952f2a3d446008b2961c","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f00486348c0a47f5930d481db6e8e810d703ab2a2ef3952f2a3d446008b2961c"} {"level":"debug","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7291e18bbfb1a52a87d56727257f143dad20b6ca66ad9234352464e5827a4047","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7291e18bbfb1a52a87d56727257f143dad20b6ca66ad9234352464e5827a4047"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0657a718a32ab2c4c84fab6147bac03cf04a4ac8ac2dd33a1bf7c2b887ba1fcf","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2847a797e51c601ac1c7fa61c74df41b7b8d59eac93bfdabd35840bb70c143c","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0657a718a32ab2c4c84fab6147bac03cf04a4ac8ac2dd33a1bf7c2b887ba1fcf"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2847a797e51c601ac1c7fa61c74df41b7b8d59eac93bfdabd35840bb70c143c"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"937db17ce321453beb504bbd1ef52164623dcbb10730405c44af3b2d9ff6488e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"error","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"57e1dd39dfafe1bc28c72170d72592d58a97ba0d68fe72d1a29398cc407201bb","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/937db17ce321453beb504bbd1ef52164623dcbb10730405c44af3b2d9ff6488e"} {"level":"error","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0aa3b2c5d8e3f9b959ac14a96ecb397977a3b68d8e3faea07e418e7bee4b2852","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4917362a93b39a0e8ac7a01cd6a02b349b0002bc4d0189ca07dcaba94080ab9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"error","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"742f45cb4a26ef7e89320f9c01d7765d0280b89954f426124ccbe324a4f81e10","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T20:09:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/57e1dd39dfafe1bc28c72170d72592d58a97ba0d68fe72d1a29398cc407201bb"} {"level":"error","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0aa3b2c5d8e3f9b959ac14a96ecb397977a3b68d8e3faea07e418e7bee4b2852"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5200300cc37b291811a3f855d1896752c5dc2dbb1f0a530675c76e460b95b1ad","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"77bc78f4b3f50085cd9b618cf911678f162b39c83979c7e4fbde478224a7fbc4","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4917362a93b39a0e8ac7a01cd6a02b349b0002bc4d0189ca07dcaba94080ab9"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe495fb3a20ffe4305e880d4e96451b9009bdb062188c5c186580376ad9550db","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/742f45cb4a26ef7e89320f9c01d7765d0280b89954f426124ccbe324a4f81e10"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32a9e057a299a39db75f214f6977f9854b84d5ae2073d2c94b80fe1d90b8ce04","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e6f97458dcdbb35852a05ed87d157791eb0419b2af7bbce1ff3684b4fd02feb","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5200300cc37b291811a3f855d1896752c5dc2dbb1f0a530675c76e460b95b1ad"} {"level":"debug","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"320e5197375bc15242b2c403d7598ce4041c4b4e2e3f932a1058424421a64c13","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/77bc78f4b3f50085cd9b618cf911678f162b39c83979c7e4fbde478224a7fbc4"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe495fb3a20ffe4305e880d4e96451b9009bdb062188c5c186580376ad9550db"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32a9e057a299a39db75f214f6977f9854b84d5ae2073d2c94b80fe1d90b8ce04"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e6f97458dcdbb35852a05ed87d157791eb0419b2af7bbce1ff3684b4fd02feb"} {"level":"info","ts":"2026-07-13T20:09:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/320e5197375bc15242b2c403d7598ce4041c4b4e2e3f932a1058424421a64c13"} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52258","PortSpecifier":{"PortValue":52258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52258","PortSpecifier":{"PortValue":52258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973381,"nanos":544792409},"http":{"id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"]}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d93bbcab-2fbe-417a-8316-5bd1c7f675af","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:55978","PortSpecifier":{"PortValue":55978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:55978","PortSpecifier":{"PortValue":55978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973381,"nanos":585800079},"http":{"id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","method":"POST","headers":{":authority":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"]}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0657a718a32ab2c4c84fab6147bac03cf04a4ac8ac2dd33a1bf7c2b887ba1fcf"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0f6c77cf-8cb6-42ce-81b9-833e78d76db1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973381,"nanos":624699433},"http":{"id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv\"}"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","subscription":"e2e-rate-iso-a-f15b0c","tenant":"e2e-shared-a-452240","userId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-f15b0c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f15b0c"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","selected_subscription":"e2e-rate-iso-a-f15b0c","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-f15b0c@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b104afe9-5419-4d2c-80a4-88b2020ab47d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c63c47a-c71b-4fa8-8755-1870954d169c","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973382,"nanos":684066298},"http":{"id":"6c63c47a-c71b-4fa8-8755-1870954d169c","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv\"}"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","subscription":"e2e-rate-iso-a-f15b0c","tenant":"e2e-shared-a-452240","userId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-f15b0c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f15b0c"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","selected_subscription":"e2e-rate-iso-a-f15b0c","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-f15b0c@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c63c47a-c71b-4fa8-8755-1870954d169c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52292","PortSpecifier":{"PortValue":52292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52292","PortSpecifier":{"PortValue":52292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973383,"nanos":718381653},"http":{"id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dMlNe6edCUFNH9Rz_jvP6gkJItlpkaa7uUh6URMaxoKiTKd5EtGSGfQslaIv\"}"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","subscription":"e2e-rate-iso-a-f15b0c","tenant":"e2e-shared-a-452240","userId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-f15b0c\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f15b0c"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a7263a9d-c14b-4808-a4f8-1d560a7bc2f6","keyName":"e2e-rate-a-f15b0c","selected_subscription":"e2e-rate-iso-a-f15b0c","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-f15b0c@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f15b0c","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f51969a-1231-4c88-9b57-fae7bae37dc5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35776","PortSpecifier":{"PortValue":35776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35776","PortSpecifier":{"PortValue":35776}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973392,"nanos":380629669},"http":{"id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"]}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b3649b8-35a6-49eb-84cd-edf61d569ba8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:41884","PortSpecifier":{"PortValue":41884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"96fa299f-dc80-48f1-8750-107a89633e8b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:41884","PortSpecifier":{"PortValue":41884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973392,"nanos":414026636},"http":{"id":"96fa299f-dc80-48f1-8750-107a89633e8b","method":"POST","headers":{":authority":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"]}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/534fc34ee41d"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0fdd47f1-1c93-4279-a353-0e63c0d09dba"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ec5d5697-ab7b-4314-ad04-744a8e5ae528","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"0657a718a32ab2c4c84fab6147bac03cf04a4ac8ac2dd33a1bf7c2b887ba1fcf"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"96fa299f-dc80-48f1-8750-107a89633e8b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35790","PortSpecifier":{"PortValue":35790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"149a9b93-73d7-4c78-958c-49dca2e22853","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35790","PortSpecifier":{"PortValue":35790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973392,"nanos":449641433},"http":{"id":"149a9b93-73d7-4c78-958c-49dca2e22853","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149a9b93-73d7-4c78-958c-49dca2e22853","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35800","PortSpecifier":{"PortValue":35800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973393,"nanos":484091321},"http":{"id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7a11ec3-e52f-48f2-81ef-71e40d7877d1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35812","PortSpecifier":{"PortValue":35812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35812","PortSpecifier":{"PortValue":35812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973394,"nanos":517029437},"http":{"id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68664948-58cf-4c5f-a4d7-e9ba6c581dbd","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35824","PortSpecifier":{"PortValue":35824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35824","PortSpecifier":{"PortValue":35824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973395,"nanos":551958894},"http":{"id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e53f495f-97b5-9cae-9a3b-7eec47bd2ad8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35836","PortSpecifier":{"PortValue":35836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35836","PortSpecifier":{"PortValue":35836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973396,"nanos":587372497},"http":{"id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6266c0c-ae5d-4f84-99f4-b9eeb4ea6ad0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35848","PortSpecifier":{"PortValue":35848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35848","PortSpecifier":{"PortValue":35848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973397,"nanos":622376249},"http":{"id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9b6e0de-0043-4d7a-9fcf-b8966905b259","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35850","PortSpecifier":{"PortValue":35850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:35850","PortSpecifier":{"PortValue":35850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973398,"nanos":656768331},"http":{"id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12c3fc46-0123-4086-ab97-2c84d55cbb75","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49802","PortSpecifier":{"PortValue":49802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49802","PortSpecifier":{"PortValue":49802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973399,"nanos":690610342},"http":{"id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:09:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f2b949-1518-4dc9-bc49-06ec739a9d51","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49808","PortSpecifier":{"PortValue":49808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49808","PortSpecifier":{"PortValue":49808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973400,"nanos":726960081},"http":{"id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:10:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"555dbd87-92d4-4fa9-aab8-df6408b84e76","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49818","PortSpecifier":{"PortValue":49818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37decdd2-ee04-4022-925a-e1b9e1e32972","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49818","PortSpecifier":{"PortValue":49818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973401,"nanos":765689916},"http":{"id":"37decdd2-ee04-4022-925a-e1b9e1e32972","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:10:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37decdd2-ee04-4022-925a-e1b9e1e32972","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb40f398-dae3-4931-8907-357d38062b91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49830","PortSpecifier":{"PortValue":49830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb40f398-dae3-4931-8907-357d38062b91","method":"POST","path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions","host":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb40f398-dae3-4931-8907-357d38062b91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:49830","PortSpecifier":{"PortValue":49830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973402,"nanos":800246655},"http":{"id":"bb40f398-dae3-4931-8907-357d38062b91","method":"POST","headers":{":authority":"e2e-shared-a-452240.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-452240/rate-test-model-452240/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-p1bjMNfBvJidKml8_x9A6Zx7Vnr515hCrQDsDljgGpzEtadonJ0tfwKZkrBo\"}"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","subscription":"e2e-rate-iso-a-2c332e","tenant":"e2e-shared-a-452240","userId":"56240cb1-f594-4349-a926-64e73a61ff92","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\",\"requestedSubscription\":\"e2e-rate-iso-a-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-452240.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb40f398-dae3-4931-8907-357d38062b91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-452240/rate-test-model-452240\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2c332e"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb40f398-dae3-4931-8907-357d38062b91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"56240cb1-f594-4349-a926-64e73a61ff92","keyName":"e2e-rate-a-2c332e","selected_subscription":"e2e-rate-iso-a-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-a-452240/e2e-rate-iso-a-2c332e@ai-tenant-e2e-shared-a-452240/rate-test-model-452240","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-452240","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2c332e","namespace":"ai-tenant-e2e-shared-a-452240","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb40f398-dae3-4931-8907-357d38062b91","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb40f398-dae3-4931-8907-357d38062b91","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32e84b02-8449-4002-9638-53b1205ab22b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:51002","PortSpecifier":{"PortValue":51002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32e84b02-8449-4002-9638-53b1205ab22b","method":"POST","path":"/ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac/v1/completions","host":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32e84b02-8449-4002-9638-53b1205ab22b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:51002","PortSpecifier":{"PortValue":51002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783973402,"nanos":836603170},"http":{"id":"32e84b02-8449-4002-9638-53b1205ab22b","method":"POST","headers":{":authority":"e2e-shared-b-83eaac.apps.03d6c2da-bfe2-4c20-914a-534fc34ee41d.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XYtRR27CtbfldIzK_C9eKjeEmVRrWJj0PnkxwpnuGPQGVpF8WfDqV5SKzyOH"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-83eaac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XYtRR27CtbfldIzK_C9eKjeEmVRrWJj0PnkxwpnuGPQGVpF8WfDqV5SKzyOH\"}"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-83eaac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e2b4919a-1b9e-4e91-ab0c-24e4c7091f7b","keyName":"e2e-rate-b-2c332e","subscription":"e2e-rate-iso-b-2c332e","tenant":"e2e-shared-b-83eaac","userId":"e2b4919a-1b9e-4e91-ab0c-24e4c7091f7b","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-83eaac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac\",\"requestedSubscription\":\"e2e-rate-iso-b-2c332e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-83eaac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-83eaac","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2c332e","namespace":"ai-tenant-e2e-shared-b-83eaac","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32e84b02-8449-4002-9638-53b1205ab22b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-2c332e"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32e84b02-8449-4002-9638-53b1205ab22b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e2b4919a-1b9e-4e91-ab0c-24e4c7091f7b","keyName":"e2e-rate-b-2c332e","selected_subscription":"e2e-rate-iso-b-2c332e","selected_subscription_key":"ai-tenant-e2e-shared-b-83eaac/e2e-rate-iso-b-2c332e@ai-tenant-e2e-shared-b-83eaac/rate-test-model-83eaac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-83eaac","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2c332e","namespace":"ai-tenant-e2e-shared-b-83eaac","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32e84b02-8449-4002-9638-53b1205ab22b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-13T20:10:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32e84b02-8449-4002-9638-53b1205ab22b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-13T20:10:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/21cef218806a484146f5d3032f014a054189e33782d0d476546bb4ebbcfd9631"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/320e5197375bc15242b2c403d7598ce4041c4b4e2e3f932a1058424421a64c13"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2847a797e51c601ac1c7fa61c74df41b7b8d59eac93bfdabd35840bb70c143c"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57e1dd39dfafe1bc28c72170d72592d58a97ba0d68fe72d1a29398cc407201bb"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7291e18bbfb1a52a87d56727257f143dad20b6ca66ad9234352464e5827a4047"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe495fb3a20ffe4305e880d4e96451b9009bdb062188c5c186580376ad9550db"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b432115016824903abc8fb28a2d5fa8f421efb65b6e79d4aeb5b6a9cb983c281"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/937db17ce321453beb504bbd1ef52164623dcbb10730405c44af3b2d9ff6488e"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9cd45ae4ed7a231d66fd12262f24f603cbf55f91cdbf4349413572c519d4b72"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c269e36484b55bca08eb8f6bba14d14b9f9dab7e0beb0a32377246b03d7fee95"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/32a9e057a299a39db75f214f6977f9854b84d5ae2073d2c94b80fe1d90b8ce04"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0aa3b2c5d8e3f9b959ac14a96ecb397977a3b68d8e3faea07e418e7bee4b2852"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e6f97458dcdbb35852a05ed87d157791eb0419b2af7bbce1ff3684b4fd02feb"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97485d9da420421b57eae0169256de390aaf34c6cb14937cd274b0ed51d26b55"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9862f526d1e4e3f7530aa24db9634368eedba0763f04d7e378e3655a362e93c6"} {"level":"info","ts":"2026-07-13T20:10:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/742f45cb4a26ef7e89320f9c01d7765d0280b89954f426124ccbe324a4f81e10"} {"level":"info","ts":"2026-07-13T20:10:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5200300cc37b291811a3f855d1896752c5dc2dbb1f0a530675c76e460b95b1ad"} {"level":"info","ts":"2026-07-13T20:10:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e239bb744ad357288d92a917e9a1f5cba67452f6e5b889305fc98da0787d114e"} {"level":"info","ts":"2026-07-13T20:10:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/baeb6288a0145011d9b04253d08653b957a999f104e36c0bf0f77dd5878bc04a"} {"level":"info","ts":"2026-07-13T20:10:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f00486348c0a47f5930d481db6e8e810d703ab2a2ef3952f2a3d446008b2961c"} {"level":"info","ts":"2026-07-13T20:11:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8dc8b94046522890813f5d297f72716f3aa12ab01382309b4a555429dcd52a87"} {"level":"info","ts":"2026-07-13T20:11:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0657a718a32ab2c4c84fab6147bac03cf04a4ac8ac2dd33a1bf7c2b887ba1fcf"} {"level":"info","ts":"2026-07-13T20:11:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77bc78f4b3f50085cd9b618cf911678f162b39c83979c7e4fbde478224a7fbc4"} {"level":"info","ts":"2026-07-13T20:11:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a4917362a93b39a0e8ac7a01cd6a02b349b0002bc4d0189ca07dcaba94080ab9"}