{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01321b41-e276-4c5f-975a-be0dff248e9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56158","PortSpecifier":{"PortValue":56158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a11aa7.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:56158","PortSpecifier":{"PortValue":56158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915270,"nanos":288461120},"http":{"id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","method":"POST","headers":{":authority":"e2e-shared-b-a11aa7.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"77099316-448e-43e9-8b62-c699bfdde580","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"]}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"77099316-448e-43e9-8b62-c699bfdde580","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"609709bbc51e384e4006d562b983334c97224b9ca5dabfb9839386dc0e618129"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a11aa7.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a11aa7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"651aeaaf-eb2c-43b4-8b4e-3960c99e2693","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41266","PortSpecifier":{"PortValue":41266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:41266","PortSpecifier":{"PortValue":41266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915270,"nanos":328461037},"http":{"id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9a1d3a8-9f48-4540-b4fa-b6bf51996f4e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42566","PortSpecifier":{"PortValue":42566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915271,"nanos":366540634},"http":{"id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a96e6c6-ecf1-4d87-a254-93b3fa6d3365","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42568","PortSpecifier":{"PortValue":42568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42568","PortSpecifier":{"PortValue":42568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915272,"nanos":408567424},"http":{"id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2c28609-c6e9-432b-bdf9-f95d8d266ba5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42580","PortSpecifier":{"PortValue":42580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"197c927c-0481-42d6-b31a-0f072ee43e6c","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42580","PortSpecifier":{"PortValue":42580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915273,"nanos":446227455},"http":{"id":"197c927c-0481-42d6-b31a-0f072ee43e6c","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"197c927c-0481-42d6-b31a-0f072ee43e6c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42588","PortSpecifier":{"PortValue":42588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42588","PortSpecifier":{"PortValue":42588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915274,"nanos":487287215},"http":{"id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd65299b-77a9-4374-b7f6-6d7132e02c67","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42590","PortSpecifier":{"PortValue":42590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42590","PortSpecifier":{"PortValue":42590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915275,"nanos":524148429},"http":{"id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cef5c0e4-17bb-4ca7-8fa6-8c0222bcce4a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42594","PortSpecifier":{"PortValue":42594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42594","PortSpecifier":{"PortValue":42594}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915276,"nanos":563053395},"http":{"id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f3e5811-1a02-4d58-a4dd-d84ba771b36c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42596","PortSpecifier":{"PortValue":42596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7901ac3b-78d7-48e5-b948-890386abea1c","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42596","PortSpecifier":{"PortValue":42596}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915277,"nanos":602291083},"http":{"id":"7901ac3b-78d7-48e5-b948-890386abea1c","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7901ac3b-78d7-48e5-b948-890386abea1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42600","PortSpecifier":{"PortValue":42600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6292aaee-9759-4b58-91c1-29d80585ddbb","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42600","PortSpecifier":{"PortValue":42600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915278,"nanos":639660841},"http":{"id":"6292aaee-9759-4b58-91c1-29d80585ddbb","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6292aaee-9759-4b58-91c1-29d80585ddbb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42614","PortSpecifier":{"PortValue":42614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42614","PortSpecifier":{"PortValue":42614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915279,"nanos":677672213},"http":{"id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:47:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"beac10fd-2321-4a4a-aa0e-6a96c83767be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42624","PortSpecifier":{"PortValue":42624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c889e0c4-c7b7-4054-9649-1c3479f21923","method":"POST","path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions","host":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:42624","PortSpecifier":{"PortValue":42624}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915280,"nanos":715594996},"http":{"id":"c889e0c4-c7b7-4054-9649-1c3479f21923","method":"POST","headers":{":authority":"e2e-shared-a-028d4b.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PhJK4G2ludeAbGbY_mAkz7iyWJp0equw0U6scxfCoa9r0pcfLyrFTVMCqZEe\"}"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","subscription":"e2e-rate-iso-a-e71a30","tenant":"e2e-shared-a-028d4b","userId":"6ad76d61-9cce-45d2-a320-beef8737367e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\",\"requestedSubscription\":\"e2e-rate-iso-a-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-028d4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-028d4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e71a30"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"6ad76d61-9cce-45d2-a320-beef8737367e","keyName":"e2e-rate-a-e71a30","selected_subscription":"e2e-rate-iso-a-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-a-028d4b/e2e-rate-iso-a-e71a30@ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-028d4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e71a30","namespace":"ai-tenant-e2e-shared-a-028d4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-028d4b/rate-test-model-028d4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c889e0c4-c7b7-4054-9649-1c3479f21923","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47613942-6128-47b1-9827-354efe27104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33242","PortSpecifier":{"PortValue":33242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47613942-6128-47b1-9827-354efe27104e","method":"POST","path":"/ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7/v1/completions","host":"e2e-shared-b-a11aa7.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47613942-6128-47b1-9827-354efe27104e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:33242","PortSpecifier":{"PortValue":33242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915280,"nanos":753591019},"http":{"id":"47613942-6128-47b1-9827-354efe27104e","method":"POST","headers":{":authority":"e2e-shared-b-a11aa7.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-TQzpMgPO7bQGflbl_mr8CxaU5A3KhZ2R0yUbPLX4YuFonRvfP0Rb8ObSnVdd"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47613942-6128-47b1-9827-354efe27104e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-a11aa7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-TQzpMgPO7bQGflbl_mr8CxaU5A3KhZ2R0yUbPLX4YuFonRvfP0Rb8ObSnVdd\"}"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a11aa7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"874574a7-63ee-4420-abf4-a0fd0f129319","keyName":"e2e-rate-b-e71a30","subscription":"e2e-rate-iso-b-e71a30","tenant":"e2e-shared-b-a11aa7","userId":"874574a7-63ee-4420-abf4-a0fd0f129319","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47613942-6128-47b1-9827-354efe27104e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-a11aa7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7\",\"requestedSubscription\":\"e2e-rate-iso-b-e71a30\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a11aa7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a11aa7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e71a30","namespace":"ai-tenant-e2e-shared-b-a11aa7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7"}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47613942-6128-47b1-9827-354efe27104e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a11aa7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"874574a7-63ee-4420-abf4-a0fd0f129319","keyName":"e2e-rate-b-e71a30","selected_subscription":"e2e-rate-iso-b-e71a30","selected_subscription_key":"ai-tenant-e2e-shared-b-a11aa7/e2e-rate-iso-b-e71a30@ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a11aa7","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e71a30","namespace":"ai-tenant-e2e-shared-b-a11aa7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a11aa7/rate-test-model-a11aa7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e71a30"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47613942-6128-47b1-9827-354efe27104e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47613942-6128-47b1-9827-354efe27104e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:48:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47613942-6128-47b1-9827-354efe27104e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a314c633182f67a8566a04cec7b9d1c6ec905bd849a8d5baf79847994ca2f0c"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fbaa6273475646c51883b948446fb5b4cefc89c87e89632b0c81bdc6d3217dfc"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/609709bbc51e384e4006d562b983334c97224b9ca5dabfb9839386dc0e618129"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/243088e2f9dd8ae9281ee4b5adf71d31e21e9e6ee47e04bb3966c4e8582c10af"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80ec80b39dd9d5e182c6f9f88d6a1300991b21e54c956633a6df53a2a03589ec"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d8c710c350235a19035097efa5002e59e170dfeb4881d14ad38e2fc5a394371c"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71abcf06a467b4ef70bf2e008f390906096ce19c624a7714d80dad9320213152"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5db1ee3b2b6c71bd618b1b54f69e3504b92c4665b9bf6130a5e77024a58eedd7"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db040c01e29778a9a01c0080cab071ae0a9841a55a91d9a0ae32ca14a4167736"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71a1bcc5ec9bccf2efb19a4fc4efef5ab873da06793e5306dcbb5dd7fbd8c7db"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4c05cc471216b13c46de47d2509727e79711241e54091addb24cbe1838d3d4be"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e6ab4c4cd4dd2554f0f66e2d696e4ee4190c41661dc9668c347f2b85f88b3a2e"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aa6713df73ea72f662eb42447abf97792949eb1a721146ad9900af7f0a30bf72"}
{"level":"info","ts":"2026-07-24T17:48:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/005c932647d4602e735ef5ba071492b37c0f923b6f67123a8264c364a5f920bb"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc302bdebf89444b29ab4fab24523f4ab90a63eba651f6dcf847590434fc15d4"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/391d4e7aad146998edb0a21b1a05b1519fe3fb5dc926563d3c48d3fad0d4f9f0"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/88df2cdccf30ff2ccd1359ad99168a934487a0b65b16f413b8bb06380722d2bb"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94811494a7346df95b397b9304b3344c6261e2a51b5f27f63c41595517125d30"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/823c67189a85c8bd3f0aa09fdd158a6440a92b1b9aa849461b3ae8b7d2ce7aee"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47f05171c359eec25f80e35f5233ae194e13fe4525bdc6118acc51e7b671e645"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4777661de84534110223cd97ac33d86f82f8f0ca25991e22550cf23713d8b68e"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/59c4574fcd06eef87f466b6c072194c1049ee229f017ef74c8b50640c93c74be"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8faad065bc216f61a10c22052b67c0859a7995e1c6674bf8976993d1670747f9"}
{"level":"info","ts":"2026-07-24T17:48:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/127b5ebbd6ed434866a1a2eccb9a08a82ce7315025ee59bad35cdbe3dc559ac0"}
{"level":"info","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55230","PortSpecifier":{"PortValue":55230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ae564f7e-8263-463a-a093-d10eaadcb541","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55230","PortSpecifier":{"PortValue":55230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915344,"nanos":608203126},"http":{"id":"ae564f7e-8263-463a-a093-d10eaadcb541","method":"POST","headers":{":authority":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"77099316-448e-43e9-8b62-c699bfdde580","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"]}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"77099316-448e-43e9-8b62-c699bfdde580","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae564f7e-8263-463a-a093-d10eaadcb541","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55234","PortSpecifier":{"PortValue":55234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:55234","PortSpecifier":{"PortValue":55234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.43:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915344,"nanos":655144166},"http":{"id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","method":"POST","headers":{":authority":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZOEFMZDUKBXxaJcD_ZRau3KslcAVOIPgNUCodmM1mrn6IM2iZNeV5YMZBVR9"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZOEFMZDUKBXxaJcD_ZRau3KslcAVOIPgNUCodmM1mrn6IM2iZNeV5YMZBVR9\"}"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"924f9d6d-40a9-467a-a41e-c7cd5e0c15b3","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"924f9d6d-40a9-467a-a41e-c7cd5e0c15b3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.43:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"924f9d6d-40a9-467a-a41e-c7cd5e0c15b3","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c741e7d3-8d83-486d-bcac-1aeaf9aa3aeb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce"}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466"}
{"level":"error","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"}
{"level":"error","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:49:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530"}
{"level":"debug","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d"}
{"level":"info","ts":"2026-07-24T17:49:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"}
{"level":"info","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35040","PortSpecifier":{"PortValue":35040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c13355c4-d5f5-4861-97f7-aef63368d3da","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-052d9d.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:35040","PortSpecifier":{"PortValue":35040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915399,"nanos":751657203},"http":{"id":"c13355c4-d5f5-4861-97f7-aef63368d3da","method":"POST","headers":{":authority":"e2e-ipp-a-052d9d.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"77099316-448e-43e9-8b62-c699bfdde580","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"]}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a4e6f7d82080"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=f030dc8d-2308-4e78-aa41-72ae7dcabbc0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"77099316-448e-43e9-8b62-c699bfdde580","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.75:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-052d9d.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-052d9d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:49:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c13355c4-d5f5-4861-97f7-aef63368d3da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"febd543d-7e18-49f3-a205-9be7ef741894","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43552","PortSpecifier":{"PortValue":43552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"febd543d-7e18-49f3-a205-9be7ef741894","method":"POST","path":"/ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d/v1/chat/completions","host":"e2e-ipp-a-052d9d.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"febd543d-7e18-49f3-a205-9be7ef741894","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:43552","PortSpecifier":{"PortValue":43552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915401,"nanos":825401441},"http":{"id":"febd543d-7e18-49f3-a205-9be7ef741894","method":"POST","headers":{":authority":"e2e-ipp-a-052d9d.apps.eb1aef30-c802-409a-912f-a4e6f7d82080.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pwD2k4Db6MFJ1PNw_cCyoQ1C3fLcYGBYDI0i7buCUkbTJ5j6mX60VMXFHQgf"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-052d9d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pwD2k4Db6MFJ1PNw_cCyoQ1C3fLcYGBYDI0i7buCUkbTJ5j6mX60VMXFHQgf\"}"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-052d9d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddad415d-27d4-42c9-add7-c086c37a1678","keyName":"e2e-ipp-052d9d","subscription":"ipp-route-052d9d-sub","tenant":"e2e-ipp-a-052d9d","userId":"ddad415d-27d4-42c9-add7-c086c37a1678","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-052d9d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d\",\"requestedSubscription\":\"ipp-route-052d9d-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-052d9d.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-052d9d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-052d9d-sub","namespace":"ai-tenant-e2e-ipp-a-052d9d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d"}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"febd543d-7e18-49f3-a205-9be7ef741894","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-052d9d/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-052d9d-sub"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"febd543d-7e18-49f3-a205-9be7ef741894","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddad415d-27d4-42c9-add7-c086c37a1678","keyName":"e2e-ipp-052d9d","selected_subscription":"ipp-route-052d9d-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d-sub@ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-052d9d","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-052d9d-sub","namespace":"ai-tenant-e2e-ipp-a-052d9d","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-052d9d/ipp-route-052d9d"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"febd543d-7e18-49f3-a205-9be7ef741894","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:50:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"febd543d-7e18-49f3-a205-9be7ef741894","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56c5d479e45fd1d94288ff655622adc2151580e1251cba2fad0cd6eabe5008cf"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/357767149a7c094a393d76c918981bfcb1ce8c8bcac2e8fa76915a3a4cffc5e2"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c77cea577ec408ef0c24a26cc1ef59cc053ce375c87dd6563d70671b1ad88466"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a1110bedbda65cd9dfa562f490a293bf8b2b04d473d65a62b5dcc1a2075dc2d"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc10b8e20ece4d6f823c45c7d7994ec98ee75083a285e668687a2ac0b3682530"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/60e89327bafc3ac795feea754df4b4868e2902bd24f59fa6195682e94cd353ce"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3510ea72c7ec0c34a6f5d25246abaa7a6d88d3da73ca096615da6ae48d690a8c"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86b7406dc0f5d53c94ce029bdcc382d29ffb26638160dde6b9f6760d00c07780"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1dff590155de57edc0e08b2fbd522a075142568961a95acf2a590ced539f5cc2"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3dfa948148344ec9654d789f185aa96f28e3d7f969ad4564616dc375c03b187"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab5417fd3965668e1f3310016d9c430b35fc0a30351add46f43c44e2dc415b47"}
{"level":"info","ts":"2026-07-24T17:51:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/72829687364be2a9f8a2dad93c08d651567c65fd2653deaab133969205373bde"}