--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"debug","ts":"2026-07-02T17:35:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:35:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:35:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a"}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cadf7a3f7bbdb10b158319afc01a5cd18a4b30f7a8560713ca920df1e5fd5f4f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cadf7a3f7bbdb10b158319afc01a5cd18a4b30f7a8560713ca920df1e5fd5f4f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cadf7a3f7bbdb10b158319afc01a5cd18a4b30f7a8560713ca920df1e5fd5f4f"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b55f39e5f2c4a43a78b732c00d5535ce59fce81dc515c2c3be25a33093756998","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b55f39e5f2c4a43a78b732c00d5535ce59fce81dc515c2c3be25a33093756998","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b55f39e5f2c4a43a78b732c00d5535ce59fce81dc515c2c3be25a33093756998"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"852981bc62b429295b48dde38da1349d14baab918a6b4316b7cb510b97b8632f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/852981bc62b429295b48dde38da1349d14baab918a6b4316b7cb510b97b8632f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/852981bc62b429295b48dde38da1349d14baab918a6b4316b7cb510b97b8632f"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"43d3cd3fa87aa6ae66a987a6e60982dac07a0b88901f5b5f14ecf637f597d667","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/43d3cd3fa87aa6ae66a987a6e60982dac07a0b88901f5b5f14ecf637f597d667","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/43d3cd3fa87aa6ae66a987a6e60982dac07a0b88901f5b5f14ecf637f597d667"}
{"level":"debug","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a8ea3a717594eb5b5436ee7a6a2cd5655a2156ad21c3ba4c948bb2f4bd2afb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a8ea3a717594eb5b5436ee7a6a2cd5655a2156ad21c3ba4c948bb2f4bd2afb9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a8ea3a717594eb5b5436ee7a6a2cd5655a2156ad21c3ba4c948bb2f4bd2afb9"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1"}
{"level":"debug","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46002","PortSpecifier":{"PortValue":46002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46002","PortSpecifier":{"PortValue":46002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013780,"nanos":526654483},"http":{"id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/sub-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e89c1652-d92a-4dfe-a9b8-b48dc7965304","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36018","PortSpecifier":{"PortValue":36018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36018","PortSpecifier":{"PortValue":36018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013780,"nanos":568562174},"http":{"id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/sub-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8701d5f0-cb2c-4cde-ac9c-15a78abb6628","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46012","PortSpecifier":{"PortValue":46012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b94db43-7b2d-4de5-9092-561b3620aff4","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:46012","PortSpecifier":{"PortValue":46012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013780,"nanos":614729515},"http":{"id":"6b94db43-7b2d-4de5-9092-561b3620aff4","method":"GET","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-QuQrANd2GQEphgMY_FMX7PMK6M2BPPMK2VkDT40GnceIgoJnlPEXp2Lix8eg"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-QuQrANd2GQEphgMY_FMX7PMK6M2BPPMK2VkDT40GnceIgoJnlPEXp2Lix8eg\"}"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7397114b-4585-4568-b47d-e2310add712d","keyName":"e2e-sub-iso-751899","subscription":"e2e-a-only-534eff","tenant":"e2e-shared-a-73dc61","userId":"7397114b-4585-4568-b47d-e2310add712d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/sub-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-534eff"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b94db43-7b2d-4de5-9092-561b3620aff4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4e71240-8949-4b40-983d-6891acc890fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36030","PortSpecifier":{"PortValue":36030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d4e71240-8949-4b40-983d-6891acc890fe","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d4e71240-8949-4b40-983d-6891acc890fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36030","PortSpecifier":{"PortValue":36030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013780,"nanos":645810355},"http":{"id":"d4e71240-8949-4b40-983d-6891acc890fe","method":"GET","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1R2B5Fpg6YAfNgwOY_eDLG8Br6niuJEN4v9mhl0xd0EGiDxwxz3J1viTy5sCa"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1R2B5Fpg6YAfNgwOY_eDLG8Br6niuJEN4v9mhl0xd0EGiDxwxz3J1viTy5sCa\"}"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fd0a265a-91f1-404d-9095-e58d06d37a95","keyName":"e2e-sub-iso-010863","subscription":"e2e-b-only-534eff","tenant":"e2e-shared-b-b85f5a","userId":"fd0a265a-91f1-404d-9095-e58d06d37a95","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d4e71240-8949-4b40-983d-6891acc890fe","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/sub-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-534eff"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d4e71240-8949-4b40-983d-6891acc890fe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4e71240-8949-4b40-983d-6891acc890fe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d4e71240-8949-4b40-983d-6891acc890fe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60352","PortSpecifier":{"PortValue":60352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60352","PortSpecifier":{"PortValue":60352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013792,"nanos":857734792},"http":{"id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/sub-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d5632cd-94fb-4457-89cb-1d5ca4147030","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50858","PortSpecifier":{"PortValue":50858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7387c31f-5602-49d0-ba5a-34d385fcee61","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50858","PortSpecifier":{"PortValue":50858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013792,"nanos":907938008},"http":{"id":"7387c31f-5602-49d0-ba5a-34d385fcee61","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/sub-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7387c31f-5602-49d0-ba5a-34d385fcee61","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60358","PortSpecifier":{"PortValue":60358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:60358","PortSpecifier":{"PortValue":60358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013792,"nanos":955643357},"http":{"id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KFl0fRsRDuC26Vmk_2EGJC4XnwodEvdJKD8L0NPhGTMVAL4eG6sN7nMHXhw1"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KFl0fRsRDuC26Vmk_2EGJC4XnwodEvdJKD8L0NPhGTMVAL4eG6sN7nMHXhw1\"}"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bafb79b2-e7f5-400a-9564-ddf8c583bf0c","keyName":"e2e-sub-iso-d0c34b","subscription":"e2e-shared-sub-27f0d0","tenant":"e2e-shared-a-73dc61","userId":"bafb79b2-e7f5-400a-9564-ddf8c583bf0c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/sub-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-27f0d0"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"799e6dbd-e4fa-4d5b-9732-aeff70293791","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50874","PortSpecifier":{"PortValue":50874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50874","PortSpecifier":{"PortValue":50874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013792,"nanos":988995946},"http":{"id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1BYdQnliLe37fxv80_H7sz1CuZHQUygLECOlNcdRw3j7f3s0wvIs4bUwNi7ZC"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1BYdQnliLe37fxv80_H7sz1CuZHQUygLECOlNcdRw3j7f3s0wvIs4bUwNi7ZC\"}"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7ff9140b-297d-4f18-81d9-e4d6807487db","keyName":"e2e-sub-iso-adc0c6","subscription":"e2e-shared-sub-27f0d0","tenant":"e2e-shared-b-b85f5a","userId":"7ff9140b-297d-4f18-81d9-e4d6807487db","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/sub-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-27f0d0"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:36:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cbf2ea58-b28c-43a0-8ae8-aae1696d72c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:36:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b55f39e5f2c4a43a78b732c00d5535ce59fce81dc515c2c3be25a33093756998"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/012eded734c9cb588a7a925470ac403b4317cbb4ef818f77ed3d9d667c43c61a"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a8ea3a717594eb5b5436ee7a6a2cd5655a2156ad21c3ba4c948bb2f4bd2afb9"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cadf7a3f7bbdb10b158319afc01a5cd18a4b30f7a8560713ca920df1e5fd5f4f"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/43d3cd3fa87aa6ae66a987a6e60982dac07a0b88901f5b5f14ecf637f597d667"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/852981bc62b429295b48dde38da1349d14baab918a6b4316b7cb510b97b8632f"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4cc9e9a0c6bc831d4f6e3f676d372180169165074f532757b093d1e49e454430"}
{"level":"info","ts":"2026-07-02T17:36:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9828809a06a395894099dbf1a41a9fde29ce6d6925e6a104e6124f352bde401d"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3259ec02708fd8c541ba5941f5cb4c56e086c95d3d4e2ea3646fe876fb83a1c9"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4380c584b9e6f8ab1c4d007ead14d8d2bb79b97262dd94b7e121685c007b6d21"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4c2b9550b85da7dbeb871d2dd3a178403166c9db7519df2591525e0746756f3a"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e924a24095a2b9ed5736d6c804c999027b27321f74e2cb0e585fa5175071ddf1"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8caa30ec98fd9a919a784970b7d5e10c7315aa2e09e7b671a6afc2dd376f39c7"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85f7bcfd9bd23437868de8265899402676f33ef713b402d97956c48be3d4a8cb"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2ff23f018813f679c4bc8cdc21acfc25212152a13122f4f3ca21cf831d181b2d"}
{"level":"info","ts":"2026-07-02T17:36:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8f7c53f77aebcb0e0bd03f635e9c83a1df231e9a5c8aa0b879b9c2d549b1921"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a15ae66e52ca6c605ea37be4c077ae334997f38ea1cec5cb038c13eea6860c53"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66"}
{"level":"debug","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e","issuerUrl":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48406","PortSpecifier":{"PortValue":48406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48406","PortSpecifier":{"PortValue":48406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013856,"nanos":98989346},"http":{"id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bce25b39-a0c7-4699-a14d-9a28fe7845d6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:54572","PortSpecifier":{"PortValue":54572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:54572","PortSpecifier":{"PortValue":54572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013856,"nanos":143060451},"http":{"id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b86b1761-b2d4-42c1-8283-c55fbefc1ef1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48412","PortSpecifier":{"PortValue":48412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e0005d4f-cf01-43d4-958f-74ea669206a2","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48412","PortSpecifier":{"PortValue":48412}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013856,"nanos":188012183},"http":{"id":"e0005d4f-cf01-43d4-958f-74ea669206a2","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL\"}"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","subscription":"e2e-rate-iso-a-311a47","tenant":"e2e-shared-a-73dc61","userId":"c2c9fd44-f724-489b-b64d-78b58b095aae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-311a47\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-311a47"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","selected_subscription":"e2e-rate-iso-a-311a47","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-311a47@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0005d4f-cf01-43d4-958f-74ea669206a2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48416","PortSpecifier":{"PortValue":48416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48416","PortSpecifier":{"PortValue":48416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013857,"nanos":250093302},"http":{"id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL\"}"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","subscription":"e2e-rate-iso-a-311a47","tenant":"e2e-shared-a-73dc61","userId":"c2c9fd44-f724-489b-b64d-78b58b095aae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-311a47\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-311a47"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","selected_subscription":"e2e-rate-iso-a-311a47","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-311a47@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5198552b-2dd5-4fa1-ae87-b3e14ca660ef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48422","PortSpecifier":{"PortValue":48422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:48422","PortSpecifier":{"PortValue":48422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013858,"nanos":285232462},"http":{"id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-dpZ589PYHshNTPvm_ZDGE2BmiGpgIculZwKVdB1YxeiEvOfcgmlUZvNqr2PL\"}"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","subscription":"e2e-rate-iso-a-311a47","tenant":"e2e-shared-a-73dc61","userId":"c2c9fd44-f724-489b-b64d-78b58b095aae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-311a47\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-311a47"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c2c9fd44-f724-489b-b64d-78b58b095aae","keyName":"e2e-rate-a-311a47","selected_subscription":"e2e-rate-iso-a-311a47","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-311a47@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-311a47","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5eda9a25-fb12-4a99-8e8b-aae15f93148c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"77d40cf6-fc9a-42e8-a121-065a37033937","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33230","PortSpecifier":{"PortValue":33230}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":81685130},"http":{"id":"77d40cf6-fc9a-42e8-a121-065a37033937","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"77d40cf6-fc9a-42e8-a121-065a37033937","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44610","PortSpecifier":{"PortValue":44610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44610","PortSpecifier":{"PortValue":44610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":126924034},"http":{"id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a266494b-707e-47c2-90bd-1f9d43d95730","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"]}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/de7e510436c3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=bf569402-9e7d-4c0f-83be-5e04b9be42a0"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a266494b-707e-47c2-90bd-1f9d43d95730","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6e3b2e9b217d281a6cad5b2e31f3659349dcfbaf4885bdab39cdd42bdfff2c8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"768ba077-a8a1-4f48-b8e4-25e51016f8f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":172169620},"http":{"id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"241b419b-7c2b-4a02-b915-61f0cc2eb561","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33256","PortSpecifier":{"PortValue":33256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33256","PortSpecifier":{"PortValue":33256}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013868,"nanos":211666199},"http":{"id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54bd0b4a-81f4-4fef-a5ab-61d8840a5f8c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013869,"nanos":253578992},"http":{"id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a793de0-1ca5-4e93-8c12-16426aeabbdb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"399ee347-59f7-4445-9855-665e85138c00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33278","PortSpecifier":{"PortValue":33278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"399ee347-59f7-4445-9855-665e85138c00","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"399ee347-59f7-4445-9855-665e85138c00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33278","PortSpecifier":{"PortValue":33278}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013870,"nanos":291685558},"http":{"id":"399ee347-59f7-4445-9855-665e85138c00","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"399ee347-59f7-4445-9855-665e85138c00","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"399ee347-59f7-4445-9855-665e85138c00","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"399ee347-59f7-4445-9855-665e85138c00","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"399ee347-59f7-4445-9855-665e85138c00","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"399ee347-59f7-4445-9855-665e85138c00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"399ee347-59f7-4445-9855-665e85138c00","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59020","PortSpecifier":{"PortValue":59020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59020","PortSpecifier":{"PortValue":59020}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013871,"nanos":331965515},"http":{"id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"180a831c-4f35-4fe5-b8fe-ec427a9d7284","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59034","PortSpecifier":{"PortValue":59034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"226772a0-bc46-46ed-a400-8b920e0c7891","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59034","PortSpecifier":{"PortValue":59034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013872,"nanos":371563687},"http":{"id":"226772a0-bc46-46ed-a400-8b920e0c7891","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"226772a0-bc46-46ed-a400-8b920e0c7891","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef5fd5af-b859-4f81-a348-549457396393","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59046","PortSpecifier":{"PortValue":59046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef5fd5af-b859-4f81-a348-549457396393","method":"POST","path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions","host":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef5fd5af-b859-4f81-a348-549457396393","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59046","PortSpecifier":{"PortValue":59046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013873,"nanos":407333190},"http":{"id":"ef5fd5af-b859-4f81-a348-549457396393","method":"POST","headers":{":authority":"e2e-shared-a-73dc61.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-PwCGsBr3tvcA34EX_3hVLMtaBFlD4vlorWRoK4PgxxrfC1PizZznsuaHRblA\"}"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","subscription":"e2e-rate-iso-a-2df910","tenant":"e2e-shared-a-73dc61","userId":"3053926c-5ebb-4e47-a162-df3c56561ed9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\",\"requestedSubscription\":\"e2e-rate-iso-a-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-73dc61.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef5fd5af-b859-4f81-a348-549457396393","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef5fd5af-b859-4f81-a348-549457396393","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3053926c-5ebb-4e47-a162-df3c56561ed9","keyName":"e2e-rate-a-2df910","selected_subscription":"e2e-rate-iso-a-2df910","selected_subscription_key":"ai-tenant-e2e-shared-a-73dc61/e2e-rate-iso-a-2df910@ai-tenant-e2e-shared-a-73dc61/rate-test-model-73dc61","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-73dc61","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2df910","namespace":"ai-tenant-e2e-shared-a-73dc61","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef5fd5af-b859-4f81-a348-549457396393","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef5fd5af-b859-4f81-a348-549457396393","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:35036","PortSpecifier":{"PortValue":35036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"202e7e2b-6440-4f10-b936-84a666902dcb","method":"POST","path":"/ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a/v1/completions","host":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:35036","PortSpecifier":{"PortValue":35036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013873,"nanos":443202112},"http":{"id":"202e7e2b-6440-4f10-b936-84a666902dcb","method":"POST","headers":{":authority":"e2e-shared-b-b85f5a.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hvU3l9YNmMSe0QSW_d9RgCeV07ebozDZJQUHu064tctJLjaMdnutFw4s70k1"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hvU3l9YNmMSe0QSW_d9RgCeV07ebozDZJQUHu064tctJLjaMdnutFw4s70k1\"}"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"efd26b64-135e-4e0a-a719-f514a4e91745","keyName":"e2e-rate-b-2df910","subscription":"e2e-rate-iso-b-2df910","tenant":"e2e-shared-b-b85f5a","userId":"efd26b64-135e-4e0a-a719-f514a4e91745","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a\",\"requestedSubscription\":\"e2e-rate-iso-b-2df910\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b85f5a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b85f5a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2df910","namespace":"ai-tenant-e2e-shared-b-b85f5a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-2df910"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"efd26b64-135e-4e0a-a719-f514a4e91745","keyName":"e2e-rate-b-2df910","selected_subscription":"e2e-rate-iso-b-2df910","selected_subscription_key":"ai-tenant-e2e-shared-b-b85f5a/e2e-rate-iso-b-2df910@ai-tenant-e2e-shared-b-b85f5a/rate-test-model-b85f5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b85f5a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2df910","namespace":"ai-tenant-e2e-shared-b-b85f5a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"202e7e2b-6440-4f10-b936-84a666902dcb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45416","PortSpecifier":{"PortValue":45416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45416","PortSpecifier":{"PortValue":45416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013877,"nanos":80160638},"http":{"id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783013937,"groups":["Engineering","Project-Alpha"],"iat":1783013877,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:aaaf903b-670d-4784-fe80-0eaa395c0887","preferred_username":"alice_lead","scope":"profile email","sid":"S0n1NmfUSeEQmgxNqPH2YIEY","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783013937,"groups":["Engineering","Project-Alpha"],"iat":1783013877,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:aaaf903b-670d-4784-fe80-0eaa395c0887","preferred_username":"alice_lead","scope":"profile email","sid":"S0n1NmfUSeEQmgxNqPH2YIEY","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ad4ee48-3b91-49d8-9709-3fd10cd64bf0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45418","PortSpecifier":{"PortValue":45418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45418","PortSpecifier":{"PortValue":45418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013877,"nanos":264498855},"http":{"id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1aa273b-ba8c-488c-8a1b-fab3c3ddc481","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10267f49-2f73-439d-864e-4d5cd779a04c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45434","PortSpecifier":{"PortValue":45434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"10267f49-2f73-439d-864e-4d5cd779a04c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10267f49-2f73-439d-864e-4d5cd779a04c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45434","PortSpecifier":{"PortValue":45434}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013877,"nanos":334671541},"http":{"id":"10267f49-2f73-439d-864e-4d5cd779a04c","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.16","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.16","x-forwarded-host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"10267f49-2f73-439d-864e-4d5cd779a04c"},"path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"10267f49-2f73-439d-864e-4d5cd779a04c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10267f49-2f73-439d-864e-4d5cd779a04c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10267f49-2f73-439d-864e-4d5cd779a04c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fc92134-c20d-4215-9c87-bb6690094f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45438","PortSpecifier":{"PortValue":45438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fc92134-c20d-4215-9c87-bb6690094f16","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fc92134-c20d-4215-9c87-bb6690094f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45438","PortSpecifier":{"PortValue":45438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013877,"nanos":362853479},"http":{"id":"1fc92134-c20d-4215-9c87-bb6690094f16","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.16","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.16","x-forwarded-host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"1fc92134-c20d-4215-9c87-bb6690094f16"},"path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fc92134-c20d-4215-9c87-bb6690094f16","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fc92134-c20d-4215-9c87-bb6690094f16","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45454","PortSpecifier":{"PortValue":45454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:45454","PortSpecifier":{"PortValue":45454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013877,"nanos":515654401},"http":{"id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 16:37:57 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:37:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbf3002d-76aa-43f8-9ff8-181c3252e7ab","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e1152c86313c515f1d6c5334baf6ff34a44b67d0c28bbb10bc2d7701d5815fde"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3dc32d28680cf7015c5257aeb25d56f3d5569c722b0d29cbbe00fd0aa8a62975"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/100e15e785db7063e5aabb43de2f2036daeddde69c7140d433d8a615a2c68b22"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/55b11490eca1ae811c9d53619d7fe4939cc4db0e16a845d5be619b4ae6f7cda0"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8c60970047e73a6b3a6e5ec49c1b474c8470690c8d57e6151215f1052546d9f"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0258d062a8e6d658fc10302f0060fd9a001645434fbc5b9c2f17fa07a3b9778"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1dd6ba5687b25404fb64fbca80da6f84cfa2889e5a5f4e4fd7cba12a147b6601"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d4293d5a97d53e761eb3699c4be135a4fd5dcff529ef37d07c683354430bb23"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6dda4c0bd83db6892c3c1057ae2fd846b421ab218c902bbbcd016dba1374c6d7"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3bfe1bd738cd3b95c5f482787313f95b8b86ee30b3ae121c03ee03edf53d10c1"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1050f5b1dc454ab2fcc7fe6df32594c1d3a4b159c956b9232b0a53d53b960c4e"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/61f1714cefe46f90bfcf3d334b675e7f46a52f425725ebb84ccf351efa5bd0a9"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5813cbc3007f055c1a883ae57b8ede094501f81c74a63cbab385f42dcb1bad6c"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d2286b391a6c32746e5c78c82e6c4438e5c736724b6a62b34d16cd5815b0a3d"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7bc16dc3b74d5858a327c3739ad4af17445ec5164279f72ef2d4295d13f45df6"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0931a9cf6e54898152b4d2842a64fb951999c574eba41d77c971e796ceb80e86"}
{"level":"info","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43842","PortSpecifier":{"PortValue":43842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43842","PortSpecifier":{"PortValue":43842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013942,"nanos":768442323},"http":{"id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 17:38:57 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa10b187-8c2e-4107-9fe6-0d4b1cfaf867","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43846","PortSpecifier":{"PortValue":43846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0800fca2-569d-49b0-8a42-edb5ca27c541","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43846","PortSpecifier":{"PortValue":43846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":502807513},"http":{"id":"0800fca2-569d-49b0-8a42-edb5ca27c541","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Site-Reliability"],"iat":1783013943,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:551ab82e-19e8-dcde-573c-3b38a3218111","preferred_username":"bob_sre","scope":"profile email","sid":"mPsvgO6cEn-CdHvlhFOyNYSA","sub":"eaf6a9df-de51-47b3-86f2-d046bcac2aa1","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Site-Reliability"],"iat":1783013943,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:551ab82e-19e8-dcde-573c-3b38a3218111","preferred_username":"bob_sre","scope":"profile email","sid":"mPsvgO6cEn-CdHvlhFOyNYSA","sub":"eaf6a9df-de51-47b3-86f2-d046bcac2aa1","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0800fca2-569d-49b0-8a42-edb5ca27c541","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43858","PortSpecifier":{"PortValue":43858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f36abc2-c079-4c53-9438-a76713adfe75","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43858","PortSpecifier":{"PortValue":43858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":917661929},"http":{"id":"7f36abc2-c079-4c53-9438-a76713adfe75","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Engineering","Project-Alpha"],"iat":1783013943,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1f2ef76d-f9ad-a0ab-15f7-8b0dc643e5b2","preferred_username":"alice_lead","scope":"profile email","sid":"FZgEECruvc5nPrCnvMphfu2e","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Engineering","Project-Alpha"],"iat":1783013943,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1f2ef76d-f9ad-a0ab-15f7-8b0dc643e5b2","preferred_username":"alice_lead","scope":"profile email","sid":"FZgEECruvc5nPrCnvMphfu2e","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f36abc2-c079-4c53-9438-a76713adfe75","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43866","PortSpecifier":{"PortValue":43866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c349caf-5c6c-41ff-8461-470876daf9e9","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43866","PortSpecifier":{"PortValue":43866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":953344596},"http":{"id":"9c349caf-5c6c-41ff-8461-470876daf9e9","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ\"}"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","keyName":"e2e-oidc-3242d69e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c349caf-5c6c-41ff-8461-470876daf9e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66d83d8c-9bef-492c-9622-f2c499c7f257","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":982152751},"http":{"id":"66d83d8c-9bef-492c-9622-f2c499c7f257","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ\"}"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","keyName":"e2e-oidc-3242d69e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"66d83d8c-9bef-492c-9622-f2c499c7f257"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"66d83d8c-9bef-492c-9622-f2c499c7f257","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":982152751,"seconds":1783013943},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.53:40024","port":40024}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","keyName":"e2e-oidc-3242d69e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66d83d8c-9bef-492c-9622-f2c499c7f257","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43876","PortSpecifier":{"PortValue":43876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43876","PortSpecifier":{"PortValue":43876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":18332056},"http":{"id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1eF388J1KuGh107eX_e53Dwlb2ck7xG2YkTSgtxNC8FoLufkfEX4WflU9PGfZ\"}"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","keyName":"e2e-oidc-3242d69e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"38c59a7d-5374-4406-b73c-0d959c0ab51a","keyName":"e2e-oidc-3242d69e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2198ebba-fef2-4625-a23c-aae5f78f3c5c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43884","PortSpecifier":{"PortValue":43884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43884","PortSpecifier":{"PortValue":43884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":177568358},"http":{"id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18e5d44f-2c59-cf91-26cb-e0840652022f","preferred_username":"alice_lead","scope":"profile email","sid":"BJEgPdbrRFBvQk6jQXpxWFlJ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18e5d44f-2c59-cf91-26cb-e0840652022f","preferred_username":"alice_lead","scope":"profile email","sid":"BJEgPdbrRFBvQk6jQXpxWFlJ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b90e8e09-580d-4da8-8d8d-57adc8d337cf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43894","PortSpecifier":{"PortValue":43894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f870514c-1e27-4a27-8aa9-8269d99d1428","method":"DELETE","path":"/maas-api/v1/api-keys/bbbce86f-711a-4607-b7f3-dd0d68c4d101","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43894","PortSpecifier":{"PortValue":43894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":212586324},"http":{"id":"f870514c-1e27-4a27-8aa9-8269d99d1428","method":"DELETE","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/bbbce86f-711a-4607-b7f3-dd0d68c4d101",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18e5d44f-2c59-cf91-26cb-e0840652022f","preferred_username":"alice_lead","scope":"profile email","sid":"BJEgPdbrRFBvQk6jQXpxWFlJ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18e5d44f-2c59-cf91-26cb-e0840652022f","preferred_username":"alice_lead","scope":"profile email","sid":"BJEgPdbrRFBvQk6jQXpxWFlJ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/bbbce86f-711a-4607-b7f3-dd0d68c4d101",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f870514c-1e27-4a27-8aa9-8269d99d1428","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43908","PortSpecifier":{"PortValue":43908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43908","PortSpecifier":{"PortValue":43908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":247047730},"http":{"id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rExyVmpsAv64JDBc_f8zzbAgE70lHrL8w6RzU3QVt80ySqLzSQHsyyk5y5tE"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rExyVmpsAv64JDBc_f8zzbAgE70lHrL8w6RzU3QVt80ySqLzSQHsyyk5y5tE\"}"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f2e5a84-df42-48c6-8c2d-11501478e10e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43924","PortSpecifier":{"PortValue":43924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43924","PortSpecifier":{"PortValue":43924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":273602946},"http":{"id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-rExyVmpsAv64JDBc_f8zzbAgE70lHrL8w6RzU3QVt80ySqLzSQHsyyk5y5tE"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-rExyVmpsAv64JDBc_f8zzbAgE70lHrL8w6RzU3QVt80ySqLzSQHsyyk5y5tE\"}"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8fb5027b-d831-4f0b-9022-3349f32fe8b9","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfb176db-73af-41b3-872d-c66c3538016a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43938","PortSpecifier":{"PortValue":43938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bfb176db-73af-41b3-872d-c66c3538016a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfb176db-73af-41b3-872d-c66c3538016a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43938","PortSpecifier":{"PortValue":43938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":469023848},"http":{"id":"bfb176db-73af-41b3-872d-c66c3538016a","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bfb176db-73af-41b3-872d-c66c3538016a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bfb176db-73af-41b3-872d-c66c3538016a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"bfb176db-73af-41b3-872d-c66c3538016a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfb176db-73af-41b3-872d-c66c3538016a","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfb176db-73af-41b3-872d-c66c3538016a","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""},{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""}]}}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43946","PortSpecifier":{"PortValue":43946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e0b3e191-e652-449b-a80c-0a538e9c942c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43946","PortSpecifier":{"PortValue":43946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":761508831},"http":{"id":"e0b3e191-e652-449b-a80c-0a538e9c942c","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:ba40a880-963a-171d-2d03-602564d410d3","preferred_username":"alice_lead","scope":"profile email","sid":"SgHOYYAMjqBpX97KoyRji1eW","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:ba40a880-963a-171d-2d03-602564d410d3","preferred_username":"alice_lead","scope":"profile email","sid":"SgHOYYAMjqBpX97KoyRji1eW","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e0b3e191-e652-449b-a80c-0a538e9c942c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43954","PortSpecifier":{"PortValue":43954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7949d2a-66d9-4e39-b061-7c80246f750c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43954","PortSpecifier":{"PortValue":43954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":791259027},"http":{"id":"d7949d2a-66d9-4e39-b061-7c80246f750c","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Site-Reliability"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18975e00-3dab-9c5f-be80-66d4c2890a42","preferred_username":"bob_sre","scope":"profile email","sid":"-3QzwCPjS-TQMwp8mnrgF4we","sub":"eaf6a9df-de51-47b3-86f2-d046bcac2aa1","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Site-Reliability"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:18975e00-3dab-9c5f-be80-66d4c2890a42","preferred_username":"bob_sre","scope":"profile email","sid":"-3QzwCPjS-TQMwp8mnrgF4we","sub":"eaf6a9df-de51-47b3-86f2-d046bcac2aa1","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7949d2a-66d9-4e39-b061-7c80246f750c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43962","PortSpecifier":{"PortValue":43962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43962","PortSpecifier":{"PortValue":43962}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":942310563},"http":{"id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ebc2dad-be28-4d01-9e57-49f6fcad30d1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43970","PortSpecifier":{"PortValue":43970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","method":"DELETE","path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43970","PortSpecifier":{"PortValue":43970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013944,"nanos":974302580},"http":{"id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","method":"DELETE","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afdeae3e-e4c4-44ff-b18a-3f1bf2982d78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd520531-776a-9b93-98f9-54be750b7018","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43976","PortSpecifier":{"PortValue":43976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd520531-776a-9b93-98f9-54be750b7018","method":"DELETE","path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd520531-776a-9b93-98f9-54be750b7018","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43976","PortSpecifier":{"PortValue":43976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":4495973},"http":{"id":"dd520531-776a-9b93-98f9-54be750b7018","method":"DELETE","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd520531-776a-9b93-98f9-54be750b7018","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014004,"groups":["Engineering","Project-Alpha"],"iat":1783013944,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:746e3ae6-3c6d-e346-ebb2-244b0bb9bd7f","preferred_username":"alice_lead","scope":"profile email","sid":"mmu3kF3mDmp1uF8yf7BmjSMb","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/1242bc4e-24f2-40ad-8312-d90a3546f77a",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd520531-776a-9b93-98f9-54be750b7018","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd520531-776a-9b93-98f9-54be750b7018","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd520531-776a-9b93-98f9-54be750b7018","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43988","PortSpecifier":{"PortValue":43988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"be0b66ca-5e02-41b7-b679-219bf90e4336","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43988","PortSpecifier":{"PortValue":43988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":166777050},"http":{"id":"be0b66ca-5e02-41b7-b679-219bf90e4336","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:eb8ef77b-e421-3e0f-4975-1f483e83583d","preferred_username":"alice_lead","scope":"profile email","sid":"DRvi6jKB_FI3oCi6S6TzNbv3","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:eb8ef77b-e421-3e0f-4975-1f483e83583d","preferred_username":"alice_lead","scope":"profile email","sid":"DRvi6jKB_FI3oCi6S6TzNbv3","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"be0b66ca-5e02-41b7-b679-219bf90e4336","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44002","PortSpecifier":{"PortValue":44002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44002","PortSpecifier":{"PortValue":44002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":196514842},"http":{"id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-S0F5LszZJp7o1BGO_wsnGitK6FNc87VqFswBW4GQZIJyXBq1Ve4NK188Wg27"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-S0F5LszZJp7o1BGO_wsnGitK6FNc87VqFswBW4GQZIJyXBq1Ve4NK188Wg27\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"556a31b3-d255-43e2-a454-da0143270f4f","keyName":"e2e-oidc-3a3c5edb","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"556a31b3-d255-43e2-a454-da0143270f4f","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce630d53-b21a-4ab3-92a2-3b306931b90f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":203742754},"http":{"id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-S0F5LszZJp7o1BGO_wsnGitK6FNc87VqFswBW4GQZIJyXBq1Ve4NK188Wg27"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-S0F5LszZJp7o1BGO_wsnGitK6FNc87VqFswBW4GQZIJyXBq1Ve4NK188Wg27\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"556a31b3-d255-43e2-a454-da0143270f4f","keyName":"e2e-oidc-3a3c5edb","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"556a31b3-d255-43e2-a454-da0143270f4f","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-S0F5LszZJp7o1BGO_wsnGitK6FNc87VqFswBW4GQZIJyXBq1Ve4NK188Wg27","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a55783ca-492e-4e61-bac3-91897d0eb2b4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":203742754,"seconds":1783013945},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.53:40024","port":40024}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"556a31b3-d255-43e2-a454-da0143270f4f","keyName":"e2e-oidc-3a3c5edb","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a55783ca-492e-4e61-bac3-91897d0eb2b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44006","PortSpecifier":{"PortValue":44006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"addcf090-9737-4c40-8aae-a85767ad0aea","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44006","PortSpecifier":{"PortValue":44006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":363783135},"http":{"id":"addcf090-9737-4c40-8aae-a85767ad0aea","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:fdae5666-7d52-3d85-b996-de95fc080446","preferred_username":"alice_lead","scope":"profile email","sid":"ip5TVLHDxeDUZ3jwH5orBUgQ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:fdae5666-7d52-3d85-b996-de95fc080446","preferred_username":"alice_lead","scope":"profile email","sid":"ip5TVLHDxeDUZ3jwH5orBUgQ","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"addcf090-9737-4c40-8aae-a85767ad0aea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44008","PortSpecifier":{"PortValue":44008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44008","PortSpecifier":{"PortValue":44008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":398709790},"http":{"id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","keyName":"e2e-oidc-7e1b7fac","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46fdf856-4253-46c0-b3e5-4254320d9dc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44018","PortSpecifier":{"PortValue":44018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44018","PortSpecifier":{"PortValue":44018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":426160386},"http":{"id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","keyName":"e2e-oidc-7e1b7fac","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6d4cd94-6643-41e5-9042-b8b77b1f5a40","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"72392d49-1895-4a07-84d1-ee0330c41b3c","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":432770052},"http":{"id":"72392d49-1895-4a07-84d1-ee0330c41b3c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","keyName":"e2e-oidc-7e1b7fac","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-fkGWRehlgoJW2nsD_EhdYYyaDR2CQ9CSwlDqnep9pU9NB81wVDc2sCYduJ7b","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"72392d49-1895-4a07-84d1-ee0330c41b3c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"72392d49-1895-4a07-84d1-ee0330c41b3c","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":432770052,"seconds":1783013945},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.53:40024","port":40024}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"2717f2dc-1a35-46cc-a682-71d6878a86ac","keyName":"e2e-oidc-7e1b7fac","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72392d49-1895-4a07-84d1-ee0330c41b3c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91db4139-e99f-4715-ac40-2a398d562f98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44028","PortSpecifier":{"PortValue":44028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"91db4139-e99f-4715-ac40-2a398d562f98","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"91db4139-e99f-4715-ac40-2a398d562f98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44028","PortSpecifier":{"PortValue":44028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":585251445},"http":{"id":"91db4139-e99f-4715-ac40-2a398d562f98","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a7190b2c-9bad-17a4-b608-651b9a2e7faa","preferred_username":"alice_lead","scope":"profile email","sid":"X_saRaMh-3FEr6kMaIqZKw6o","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"91db4139-e99f-4715-ac40-2a398d562f98","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:a7190b2c-9bad-17a4-b608-651b9a2e7faa","preferred_username":"alice_lead","scope":"profile email","sid":"X_saRaMh-3FEr6kMaIqZKw6o","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"91db4139-e99f-4715-ac40-2a398d562f98","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91db4139-e99f-4715-ac40-2a398d562f98","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"91db4139-e99f-4715-ac40-2a398d562f98","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44040","PortSpecifier":{"PortValue":44040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5952799-502d-4cc9-b050-334e1dfa9677","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44040","PortSpecifier":{"PortValue":44040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":619498734},"http":{"id":"a5952799-502d-4cc9-b050-334e1dfa9677","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"79cd778a-6841-426f-b022-f9d21457bf88","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5952799-502d-4cc9-b050-334e1dfa9677","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":626718053},"http":{"id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"79cd778a-6841-426f-b022-f9d21457bf88","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":626718053,"seconds":1783013945},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.53:40024","port":40024}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4dd009ae-af36-45b0-83c6-8b98dcd4caed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44056","PortSpecifier":{"PortValue":44056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44056","PortSpecifier":{"PortValue":44056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":656639473},"http":{"id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","method":"GET","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"79cd778a-6841-426f-b022-f9d21457bf88","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e448a8e-cbe9-46c6-9bf9-ba6d5ccdcc21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.53:40024","PortSpecifier":{"PortValue":40024}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":663406889},"http":{"id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"79cd778a-6841-426f-b022-f9d21457bf88","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XHU83jWqEg4CCFSh_1rMo1HTAtjLJg7vgoaMHP5bHp9Bqbtt3GkCkiZ4Rpff","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.53","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01ODk2ZDRkZDQ5LXp6ZzZzCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.134.0.28~maas-default-gateway-openshift-default-5896d4dd49-zzg6s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.132.0.53","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":663406889,"seconds":1783013945},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.132.0.53:40024","port":40024}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"79cd778a-6841-426f-b022-f9d21457bf88","keyName":"e2e-oidc-6ae7e801","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"641bfc58-95b8-4295-a4bc-8cab8ddfe828","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44062","PortSpecifier":{"PortValue":44062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44062","PortSpecifier":{"PortValue":44062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.28:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013945,"nanos":813627381},"http":{"id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","method":"POST","headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:53756939-d8df-90e7-f7ce-504d9458f5ca","preferred_username":"alice_lead","scope":"profile email","sid":"9ilGY6fe6_PkjXLgYWu7onV5","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014005,"groups":["Engineering","Project-Alpha"],"iat":1783013945,"iss":"https://keycloak.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:53756939-d8df-90e7-f7ce-504d9458f5ca","preferred_username":"alice_lead","scope":"profile email","sid":"9ilGY6fe6_PkjXLgYWu7onV5","sub":"f7c333e0-19d8-4953-8d18-9c8486c2c9bc","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.28:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.6489dfcd-783c-460e-98cc-de7e510436c3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01272b48-29d6-42e1-af9d-3091fcb5b8f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8dec09a1bd683bb6315981cec9e8a2345d739f5b075b26be4acba58322b3d66"}
{"level":"info","ts":"2026-07-02T17:39:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee8ad140f6a84ccd202c77649d513ce656d165655872df1943187a96c3cee8ed"}