{"level":"debug","ts":"2026-07-27T19:23:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25059a68-e1b2-4dba-b741-55fa654d6cf1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25059a68-e1b2-4dba-b741-55fa654d6cf1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25059a68-e1b2-4dba-b741-55fa654d6cf1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25059a68-e1b2-4dba-b741-55fa654d6cf1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38140","PortSpecifier":{"PortValue":38140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38140","PortSpecifier":{"PortValue":38140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180185,"nanos":164543052},"http":{"id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"963e64cd-5598-4aa2-880d-3a1be997ebf3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38154","PortSpecifier":{"PortValue":38154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38154","PortSpecifier":{"PortValue":38154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180186,"nanos":204481181},"http":{"id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"423cadf0-c4a8-48e1-b3fb-5e9a3372883d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38160","PortSpecifier":{"PortValue":38160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38160","PortSpecifier":{"PortValue":38160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180187,"nanos":249025992},"http":{"id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f71f8207-0ea6-4df8-b7b0-62802ecd2556","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38162","PortSpecifier":{"PortValue":38162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71ec8197-fda7-4ed3-934b-2825a105de12","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38162","PortSpecifier":{"PortValue":38162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180188,"nanos":287628961},"http":{"id":"71ec8197-fda7-4ed3-934b-2825a105de12","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71ec8197-fda7-4ed3-934b-2825a105de12","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38172","PortSpecifier":{"PortValue":38172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"10c56ee6-183e-42dd-b1b5-845870fd7049","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38172","PortSpecifier":{"PortValue":38172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180189,"nanos":331089622},"http":{"id":"10c56ee6-183e-42dd-b1b5-845870fd7049","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10c56ee6-183e-42dd-b1b5-845870fd7049","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38178","PortSpecifier":{"PortValue":38178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:38178","PortSpecifier":{"PortValue":38178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180190,"nanos":370990894},"http":{"id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17a55bff-4cb1-4902-9bbd-f551f873d0a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56144","PortSpecifier":{"PortValue":56144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb0d29d8-793a-46c9-b129-12891b6abe96","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56144","PortSpecifier":{"PortValue":56144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180191,"nanos":409674492},"http":{"id":"cb0d29d8-793a-46c9-b129-12891b6abe96","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb0d29d8-793a-46c9-b129-12891b6abe96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56152","PortSpecifier":{"PortValue":56152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56152","PortSpecifier":{"PortValue":56152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180192,"nanos":448178439},"http":{"id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad4dc36f-6f5b-4135-a824-5ee2e44df9e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56164","PortSpecifier":{"PortValue":56164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","method":"POST","path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions","host":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:56164","PortSpecifier":{"PortValue":56164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180193,"nanos":490007106},"http":{"id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","method":"POST","headers":{":authority":"e2e-shared-a-7f7473.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-big7ZOAOJsr4pEXG_qlCx67ozXeB8gHgCVcOBcOwOR4rtVbb8z6fizKSmKN9\"}"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","subscription":"e2e-rate-iso-a-078030","tenant":"e2e-shared-a-7f7473","userId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\",\"requestedSubscription\":\"e2e-rate-iso-a-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7f7473.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-078030"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9632b9cf-538e-4bda-a294-ed6b1123d33c","keyName":"e2e-rate-a-078030","selected_subscription":"e2e-rate-iso-a-078030","selected_subscription_key":"ai-tenant-e2e-shared-a-7f7473/e2e-rate-iso-a-078030@ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-7f7473/models/facebook/opt-125m","name":"rate-test-model-7f7473","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-078030","namespace":"ai-tenant-e2e-shared-a-7f7473","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7f7473/rate-test-model-7f7473"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a6dd2e2-fb83-4959-90c9-8d6558469fbf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:54708","PortSpecifier":{"PortValue":54708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b935173-6677-4282-9dfb-3bffcf12a248","method":"POST","path":"/ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9/v1/completions","host":"e2e-shared-b-6710a9.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:54708","PortSpecifier":{"PortValue":54708}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180193,"nanos":528074951},"http":{"id":"2b935173-6677-4282-9dfb-3bffcf12a248","method":"POST","headers":{":authority":"e2e-shared-b-6710a9.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7nYntLJZ1JbPi1Bv_MncVbq4z5oHaELl4AnrZDE1QyDQvVDU09ea8mWDotMU"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-6710a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7nYntLJZ1JbPi1Bv_MncVbq4z5oHaELl4AnrZDE1QyDQvVDU09ea8mWDotMU\"}"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6710a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"df9f0ff3-846e-471f-a0b2-83e1a7c9db9e","keyName":"e2e-rate-b-078030","subscription":"e2e-rate-iso-b-078030","tenant":"e2e-shared-b-6710a9","userId":"df9f0ff3-846e-471f-a0b2-83e1a7c9db9e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-6710a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9\",\"requestedSubscription\":\"e2e-rate-iso-b-078030\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-6710a9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-6710a9/models/facebook/opt-125m","name":"rate-test-model-6710a9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-078030","namespace":"ai-tenant-e2e-shared-b-6710a9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9"}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-6710a9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-078030"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"df9f0ff3-846e-471f-a0b2-83e1a7c9db9e","keyName":"e2e-rate-b-078030","selected_subscription":"e2e-rate-iso-b-078030","selected_subscription_key":"ai-tenant-e2e-shared-b-6710a9/e2e-rate-iso-b-078030@ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-6710a9/models/facebook/opt-125m","name":"rate-test-model-6710a9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-078030","namespace":"ai-tenant-e2e-shared-b-6710a9","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-6710a9/rate-test-model-6710a9"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:23:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b935173-6677-4282-9dfb-3bffcf12a248","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:23:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c958dcf0506b6f14f7d1323c8c43eda9b91518316785d0e58fa43e7de945cb4"}
{"level":"info","ts":"2026-07-27T19:23:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f814dba5cf7666266e18f6f70a9dff35cd343b149a0784081b98c6bc5b32b722"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e4e129853e3825a932fa2483e135acc87a2aecebaeadba3c216bfe1610cc0292"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6fc3d1d325a617f3dd6468c943503a8df857db6dbfb951d90576bc9a30553349"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/edda6712f54e251f8aa5b4b4cbd10e544e12d9ef7ccebee2bb4b3007eed251bd"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/316fa58c9d9557a14d149155cb54e349cf99a383ccc66e5b745f1c0c6fb9337e"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5984d441bf563d84a66333e444612f4a3b2a7006f361345b24aa2cf616017fb0"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/11c8abcae6dc73e911a523ab23f2d4dc6a65c0a1bbca03ea7d35645b7ac3e826"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c35cec17cc828219a34f573d8a6f569696341d75aa3eae7131850346e2b0914"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2e6bd3f9dbb5be0b8a8ab432f4befd6e8feb296c0eb51de91f82ea20c91b45f"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec4a6d08b99cbe8e7f8cec8f0db2b5fc3a7cbd018d86ae2772d79b13a95c494c"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f082e7b1ca50677c0b322d190f7480928eb5c7bad8e55f3210cbbdbd55ae03f7"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/70ee9e93c0f6eb8c78956e7dd37f278dd1e373184ed6b5decb5fe09dd7639de9"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a3726c4e2c4c0feaf6519ec6b3be24a3ef5ffc12b93b7cd2b78ed2ad6229174"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b792817a4ed3f365c68dcad6f9c0d6c1eea94b10c15989856bcc62da2e618722"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/680a5d2f9792b8975f720e71b203ce5e16930105a75ffa08ef63709775f1b3c9"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/226806c534420613e92ea30492818bc9a8f68c6b6298c65039abf9b4dd65a0cf"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/120d3b9762728602d17d175d2d2b8ca3ef360249e307dc36400288798a2f7e48"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4fc754ae7c4e8a47921c3c693a16310391865dd8e1225f9653873b5c88107316"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bb5adf104ad10b2e201030b1d43aaccb54d3d8f21dd03f451d2758d6fdb0c313"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b7b0a184a88a0200a9c8cff5434b2683e6c562b573119736501ced9666a0e65"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d65b04be46a333c5ca37427375b2f4ae4973d8ccbbbebd979a3ebbc8083bf78b"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c61431210d0f12ff677106326ce4ecbf4fe7904f77b2161a2614e59e45c6afb"}
{"level":"info","ts":"2026-07-27T19:23:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/49b87f5379cc0590d555dfca1c7c3f1ecd3a4e1dff725944765705e82368169a"}
{"level":"info","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:57120","PortSpecifier":{"PortValue":57120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:57120","PortSpecifier":{"PortValue":57120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180258,"nanos":77178365},"http":{"id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","method":"POST","headers":{":authority":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9a37a786-fcf9-4393-aca6-a70567debcba","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c4dff2c1-be13-4898-b225-bce16bbd541a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d572b0fa5085"]}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d572b0fa5085"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c4dff2c1-be13-4898-b225-bce16bbd541a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9a37a786-fcf9-4393-aca6-a70567debcba","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1b9ae00-c3bf-46e6-9b38-caf5106d3614","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:57134","PortSpecifier":{"PortValue":57134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:57134","PortSpecifier":{"PortValue":57134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180258,"nanos":136742328},"http":{"id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","method":"POST","headers":{":authority":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-LeeRBnYCJtR554q1_KzZQx8uk21lkTNECi5YDKohe1nmZFs1UdeT7mZwRtxl"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-LeeRBnYCJtR554q1_KzZQx8uk21lkTNECi5YDKohe1nmZFs1UdeT7mZwRtxl\"}"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0d728f68-5bed-4eea-8be5-22c051dbd73b","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"0d728f68-5bed-4eea-8be5-22c051dbd73b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0d728f68-5bed-4eea-8be5-22c051dbd73b","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:24:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bc59d3e-2656-49dd-8064-12fc33a632ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"}
{"level":"info","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"error","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab"}
{"level":"info","ts":"2026-07-27T19:25:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5"}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T19:25:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T19:25:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf"}
{"level":"info","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e46783-7d31-4067-81fb-6c465025575a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:53406","PortSpecifier":{"PortValue":53406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7e46783-7d31-4067-81fb-6c465025575a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-1d1107.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7e46783-7d31-4067-81fb-6c465025575a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:53406","PortSpecifier":{"PortValue":53406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180339,"nanos":888879631},"http":{"id":"b7e46783-7d31-4067-81fb-6c465025575a","method":"POST","headers":{":authority":"e2e-ipp-a-1d1107.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b7e46783-7d31-4067-81fb-6c465025575a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"9a37a786-fcf9-4393-aca6-a70567debcba","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c4dff2c1-be13-4898-b225-bce16bbd541a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d572b0fa5085"]}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7e46783-7d31-4067-81fb-6c465025575a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d572b0fa5085"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c4dff2c1-be13-4898-b225-bce16bbd541a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"9a37a786-fcf9-4393-aca6-a70567debcba","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-1d1107.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-1d1107/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7e46783-7d31-4067-81fb-6c465025575a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e46783-7d31-4067-81fb-6c465025575a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:25:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7e46783-7d31-4067-81fb-6c465025575a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:51378","PortSpecifier":{"PortValue":51378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"879f3157-0f20-4a38-be90-5bdfa28115ae","method":"POST","path":"/ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107/v1/chat/completions","host":"e2e-ipp-a-1d1107.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.10:51378","PortSpecifier":{"PortValue":51378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785180341,"nanos":961016167},"http":{"id":"879f3157-0f20-4a38-be90-5bdfa28115ae","method":"POST","headers":{":authority":"e2e-ipp-a-1d1107.apps.2c94ff41-8bf9-4c5f-9fc9-d572b0fa5085.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nyheoC5Lfcf5o4Q7_2dPIBWAhcf6ljDqto5X0m3LV6DQUxpwsXnvO1GIy8KK"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-1d1107.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nyheoC5Lfcf5o4Q7_2dPIBWAhcf6ljDqto5X0m3LV6DQUxpwsXnvO1GIy8KK\"}"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-1d1107.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8ff780e4-dc53-4731-94fc-c8cb521769f6","keyName":"e2e-ipp-1d1107","subscription":"ipp-route-1d1107-sub","tenant":"e2e-ipp-a-1d1107","userId":"8ff780e4-dc53-4731-94fc-c8cb521769f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-1d1107.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107\",\"requestedSubscription\":\"ipp-route-1d1107-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-1d1107.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-1d1107/models/facebook/opt-125m","name":"ipp-route-1d1107","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-1d1107-sub","namespace":"ai-tenant-e2e-ipp-a-1d1107","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107"}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-1d1107/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-1d1107-sub"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8ff780e4-dc53-4731-94fc-c8cb521769f6","keyName":"e2e-ipp-1d1107","selected_subscription":"ipp-route-1d1107-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107-sub@ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-1d1107/models/facebook/opt-125m","name":"ipp-route-1d1107","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-1d1107-sub","namespace":"ai-tenant-e2e-ipp-a-1d1107","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-1d1107/ipp-route-1d1107"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T19:25:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"879f3157-0f20-4a38-be90-5bdfa28115ae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T19:26:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39ec4e4362b7ea04ffb2d954582255cd4a390c388b14f3b0ecbd4886f911aeab"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/78dffcb00d0237844553e659428f3da9228a35cb8e76ac72a564b265e2bc2037"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6a8a406187729a72f0866182f81033a81a5c515f01a0c5c5c67c0408d41b1c5"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50701173134a7e5759b4d0958bb2aa9d390f82e23fe638e054d54b53127168cf"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bab0cc0c98812dbd6a555ebe9591e2bd696b14a6b14d3afba74532025a27fc6c"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d73cd1a1515f7e94eb2ebe1edd2f3ce0dfc5406c1ed64219b0ed4ce01aa5921"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/501ab6b4c7f95ae422c7f3e8e5d6a50aad83831e2de2548e59d2c63feca581e1"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de0a1e0710513650c0a9710626a3b07d124de1ca686058cf3073c517f1c122e6"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd1d8cc802efe1c7c45abce3efa454b506363c7458afe5f52b55ad91eb29dcfc"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1282793d56737c07e27e76657d6beddd5b06737d5bec042958050564ec8d8b1b"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0877ea0033c753aac1a17f97759c84391e57fdb8112a84cdfd3795ce1afd4a7"}
{"level":"info","ts":"2026-07-27T19:26:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a4d46350c26dbbf46ea921f4b4e77d857b129ea2060076fd02a4cf307c1ae381"}