{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:48:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"}
{"level":"info","ts":"2026-07-12T17:48:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"97c3dfba06711beb6782c4c187b038fb8d8748001c4029d910c807ffff303f20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/97c3dfba06711beb6782c4c187b038fb8d8748001c4029d910c807ffff303f20"}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b"}
{"level":"debug","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85d14f21d9367f3228e484977cef8644720e80f9eaf3106a764e194460a1c982","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85d14f21d9367f3228e484977cef8644720e80f9eaf3106a764e194460a1c982"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71210242ee9ed9be15b55eff2fe2874ee53af8479921d1ab7160fbfc479c7f5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71210242ee9ed9be15b55eff2fe2874ee53af8479921d1ab7160fbfc479c7f5e"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aeaeeddfba5e4947acf795be2b24a99416d1ed3cf84973e9f9d5ef457c3431dc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aeaeeddfba5e4947acf795be2b24a99416d1ed3cf84973e9f9d5ef457c3431dc"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9de63cf6884823a39c2ec2f79049ba9bd3227decf3c95c05f8b6d963d04af2e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99e71363b711e50fbec5d7777fe6b0fc295fb734825c66d3267872dea96bd07f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e1b3bf3b52cd0d0f6ab483cfa3ccf8ad433ddefd74390fc72b7a969850a0c3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9de63cf6884823a39c2ec2f79049ba9bd3227decf3c95c05f8b6d963d04af2e"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99e71363b711e50fbec5d7777fe6b0fc295fb734825c66d3267872dea96bd07f"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e1b3bf3b52cd0d0f6ab483cfa3ccf8ad433ddefd74390fc72b7a969850a0c3b"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f742118059d0bf2535a029a8f62442c4d3cf638b05ef7f4ab5364f7daa73c867","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe067611c0b9207ddfc214509838608d5dc95606a0776fb167b502c11223fa79","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-12T17:49:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f742118059d0bf2535a029a8f62442c4d3cf638b05ef7f4ab5364f7daa73c867"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1762d6ef756701a27e0549c283bbfc5f66432bdc3192fdfe34f1e27fcf832352","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"984fd75a65a0e77415b063290b2abc1daa53af714b9533ddee01b1c43145358f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe067611c0b9207ddfc214509838608d5dc95606a0776fb167b502c11223fa79"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"894cfaf2fef166c36620130799bdafd9c6d9e7d82911b386ca22fb19c756a073","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2470e50fa5bfaa8ee384f273179da8cfc447b6cf809884965dd546f8ccc3dd6b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1ba5aa45d8dfe56fdda674513b6d4ca962ab16bf8434d558834be00a8574ff7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1762d6ef756701a27e0549c283bbfc5f66432bdc3192fdfe34f1e27fcf832352"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8043f6aaabd3940b6eefd261e1505fa985cf67695a124037ed5ae0e39c36c61d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/984fd75a65a0e77415b063290b2abc1daa53af714b9533ddee01b1c43145358f"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/894cfaf2fef166c36620130799bdafd9c6d9e7d82911b386ca22fb19c756a073"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"42824faa8ef9ce8634e38fcde625cc0affc44f2ce5064ca8ca085cc81d056dc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2470e50fa5bfaa8ee384f273179da8cfc447b6cf809884965dd546f8ccc3dd6b"}
{"level":"debug","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3870a0bd1a0a97384fa467572a11f3e02bf8a38a9d98723ef83a08c988962d32","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1ba5aa45d8dfe56fdda674513b6d4ca962ab16bf8434d558834be00a8574ff7"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8043f6aaabd3940b6eefd261e1505fa985cf67695a124037ed5ae0e39c36c61d"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/42824faa8ef9ce8634e38fcde625cc0affc44f2ce5064ca8ca085cc81d056dc8"}
{"level":"info","ts":"2026-07-12T17:49:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3870a0bd1a0a97384fa467572a11f3e02bf8a38a9d98723ef83a08c988962d32"}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55168","PortSpecifier":{"PortValue":55168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55168","PortSpecifier":{"PortValue":55168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878554,"nanos":114617871},"http":{"id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"66817a8d-263f-4662-9c0d-186844a265e7","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"]}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"66817a8d-263f-4662-9c0d-186844a265e7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"71210242ee9ed9be15b55eff2fe2874ee53af8479921d1ab7160fbfc479c7f5e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f03396d1-2515-45a8-b495-4c3cb6d9e94c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:41820","PortSpecifier":{"PortValue":41820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:41820","PortSpecifier":{"PortValue":41820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878554,"nanos":155935327},"http":{"id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","method":"POST","headers":{":authority":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"66817a8d-263f-4662-9c0d-186844a265e7","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"]}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"66817a8d-263f-4662-9c0d-186844a265e7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"250b4142-3a28-4a6b-9d4a-384b68b58dd5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6114ca7b-6426-4114-a556-205182262124","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55176","PortSpecifier":{"PortValue":55176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6114ca7b-6426-4114-a556-205182262124","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6114ca7b-6426-4114-a556-205182262124","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55176","PortSpecifier":{"PortValue":55176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878554,"nanos":199799757},"http":{"id":"6114ca7b-6426-4114-a556-205182262124","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6114ca7b-6426-4114-a556-205182262124","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj\"}"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","subscription":"e2e-rate-iso-a-a91163","tenant":"e2e-shared-a-e767e8","userId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6114ca7b-6426-4114-a556-205182262124","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-a91163\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6114ca7b-6426-4114-a556-205182262124","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a91163"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6114ca7b-6426-4114-a556-205182262124","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","selected_subscription":"e2e-rate-iso-a-a91163","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-a91163@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6114ca7b-6426-4114-a556-205182262124","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6114ca7b-6426-4114-a556-205182262124","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62951ca6-799d-4942-bafb-af814ec011dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55188","PortSpecifier":{"PortValue":55188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"62951ca6-799d-4942-bafb-af814ec011dd","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62951ca6-799d-4942-bafb-af814ec011dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55188","PortSpecifier":{"PortValue":55188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878555,"nanos":264856988},"http":{"id":"62951ca6-799d-4942-bafb-af814ec011dd","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj\"}"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","subscription":"e2e-rate-iso-a-a91163","tenant":"e2e-shared-a-e767e8","userId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-a91163\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"62951ca6-799d-4942-bafb-af814ec011dd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a91163"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62951ca6-799d-4942-bafb-af814ec011dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","selected_subscription":"e2e-rate-iso-a-a91163","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-a91163@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62951ca6-799d-4942-bafb-af814ec011dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62951ca6-799d-4942-bafb-af814ec011dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55200","PortSpecifier":{"PortValue":55200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"39444086-5baf-494d-aa98-9d4f40b5a838","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55200","PortSpecifier":{"PortValue":55200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878556,"nanos":306553319},"http":{"id":"39444086-5baf-494d-aa98-9d4f40b5a838","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-AxfPwcZH3jS39JRW_LLNX9CwUKjYa3RSeaVgda44AFTH9i5uUME9QISfSULj\"}"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","subscription":"e2e-rate-iso-a-a91163","tenant":"e2e-shared-a-e767e8","userId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-a91163\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a91163"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ab455f7b-a0be-4216-9be0-88e2ac66cd87","keyName":"e2e-rate-a-a91163","selected_subscription":"e2e-rate-iso-a-a91163","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-a91163@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a91163","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39444086-5baf-494d-aa98-9d4f40b5a838","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36992","PortSpecifier":{"PortValue":36992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36992","PortSpecifier":{"PortValue":36992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878562,"nanos":957094355},"http":{"id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"66817a8d-263f-4662-9c0d-186844a265e7","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"]}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"66817a8d-263f-4662-9c0d-186844a265e7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"71210242ee9ed9be15b55eff2fe2874ee53af8479921d1ab7160fbfc479c7f5e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.72:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d361bc12-6659-49c5-9a4a-1c8dc1747812","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59954","PortSpecifier":{"PortValue":59954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:59954","PortSpecifier":{"PortValue":59954}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878562,"nanos":991006136},"http":{"id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","method":"POST","headers":{":authority":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"66817a8d-263f-4662-9c0d-186844a265e7","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"]}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1d109f73dbe"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e8ee4909-453c-493d-b777-71114a7c5e6c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"66817a8d-263f-4662-9c0d-186844a265e7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"72d1b61b-cd9a-4ea6-a0cb-66fc235c0b08","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36996","PortSpecifier":{"PortValue":36996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:36996","PortSpecifier":{"PortValue":36996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878563,"nanos":27646570},"http":{"id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42569bdd-4eab-46c4-bf3f-0c6c64ebfbd7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37004","PortSpecifier":{"PortValue":37004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37004","PortSpecifier":{"PortValue":37004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878564,"nanos":68130642},"http":{"id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29a0bfcd-0f8a-4ba9-abd4-59d83164f6e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37008","PortSpecifier":{"PortValue":37008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37008","PortSpecifier":{"PortValue":37008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878565,"nanos":103468556},"http":{"id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67e26d6b-7b44-424c-841c-e5ce4309b7fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878566,"nanos":151850806},"http":{"id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25d759b9-7572-43a5-a4b8-f88825d7d71c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37034","PortSpecifier":{"PortValue":37034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2dca724-bcec-431b-ba81-e3fd8240414f","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37034","PortSpecifier":{"PortValue":37034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878567,"nanos":183784574},"http":{"id":"f2dca724-bcec-431b-ba81-e3fd8240414f","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2dca724-bcec-431b-ba81-e3fd8240414f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37046","PortSpecifier":{"PortValue":37046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47f900e2-dff2-42c6-a172-e34ddc290230","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37046","PortSpecifier":{"PortValue":37046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878568,"nanos":229689231},"http":{"id":"47f900e2-dff2-42c6-a172-e34ddc290230","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47f900e2-dff2-42c6-a172-e34ddc290230","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37054","PortSpecifier":{"PortValue":37054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37054","PortSpecifier":{"PortValue":37054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878569,"nanos":267164063},"http":{"id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87e57a7a-908e-454c-80d6-c5c7440d55ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"991e95a3-7711-4b29-b047-d64298185aac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37062","PortSpecifier":{"PortValue":37062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"991e95a3-7711-4b29-b047-d64298185aac","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"991e95a3-7711-4b29-b047-d64298185aac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:37062","PortSpecifier":{"PortValue":37062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878570,"nanos":310525656},"http":{"id":"991e95a3-7711-4b29-b047-d64298185aac","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"991e95a3-7711-4b29-b047-d64298185aac","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991e95a3-7711-4b29-b047-d64298185aac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"991e95a3-7711-4b29-b047-d64298185aac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"991e95a3-7711-4b29-b047-d64298185aac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48534","PortSpecifier":{"PortValue":48534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48534","PortSpecifier":{"PortValue":48534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878571,"nanos":356077713},"http":{"id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c92bb92-d0b5-4228-a32f-77cb05e32bd4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48538","PortSpecifier":{"PortValue":48538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48538","PortSpecifier":{"PortValue":48538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878572,"nanos":394616004},"http":{"id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"168daa47-3683-4cf2-b128-5c0fb00ec1c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48546","PortSpecifier":{"PortValue":48546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","method":"POST","path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions","host":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:48546","PortSpecifier":{"PortValue":48546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.72:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878573,"nanos":431875515},"http":{"id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","method":"POST","headers":{":authority":"e2e-shared-a-e767e8.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-FVDzSOuyZBhiMEQm_hYLtrzhommdTJcZAcXWDHm8700OtOR5gkIb5zz0KCAs\"}"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","subscription":"e2e-rate-iso-a-8c4dfe","tenant":"e2e-shared-a-e767e8","userId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\",\"requestedSubscription\":\"e2e-rate-iso-a-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e767e8.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fc347fff-03a7-43b5-bd39-01fa796c9f09","keyName":"e2e-rate-a-8c4dfe","selected_subscription":"e2e-rate-iso-a-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-a-e767e8/e2e-rate-iso-a-8c4dfe@ai-tenant-e2e-shared-a-e767e8/rate-test-model-e767e8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e767e8","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8c4dfe","namespace":"ai-tenant-e2e-shared-a-e767e8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00cb6fc4-4867-4987-926d-5234ccc2ef2b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","method":"POST","path":"/ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6/v1/completions","host":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56036","PortSpecifier":{"PortValue":56036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783878573,"nanos":473708601},"http":{"id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","method":"POST","headers":{":authority":"e2e-shared-b-9c75b6.apps.db5da04c-c273-402f-97bd-b1d109f73dbe.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-skTaeSh8jnJliTOB_8Z2kk2LfG5R1pF3azno4v2gKN99jH3jkyvVgrFpsxiQ"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-9c75b6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-skTaeSh8jnJliTOB_8Z2kk2LfG5R1pF3azno4v2gKN99jH3jkyvVgrFpsxiQ\"}"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9c75b6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73e4d73f-9b43-4eb6-988e-2cc81819ba8b","keyName":"e2e-rate-b-8c4dfe","subscription":"e2e-rate-iso-b-8c4dfe","tenant":"e2e-shared-b-9c75b6","userId":"73e4d73f-9b43-4eb6-988e-2cc81819ba8b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-9c75b6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6\",\"requestedSubscription\":\"e2e-rate-iso-b-8c4dfe\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9c75b6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9c75b6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8c4dfe","namespace":"ai-tenant-e2e-shared-b-9c75b6","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-8c4dfe"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73e4d73f-9b43-4eb6-988e-2cc81819ba8b","keyName":"e2e-rate-b-8c4dfe","selected_subscription":"e2e-rate-iso-b-8c4dfe","selected_subscription_key":"ai-tenant-e2e-shared-b-9c75b6/e2e-rate-iso-b-8c4dfe@ai-tenant-e2e-shared-b-9c75b6/rate-test-model-9c75b6","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9c75b6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8c4dfe","namespace":"ai-tenant-e2e-shared-b-9c75b6","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-12T17:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f55f856-8efd-46bb-97a8-b48f3fa636e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-12T17:49:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5587a9ce5197a55f8e8eeeb4b68081c965eae76e62ac86abed6ff3544603bfea"}
{"level":"info","ts":"2026-07-12T17:49:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/42824faa8ef9ce8634e38fcde625cc0affc44f2ce5064ca8ca085cc81d056dc8"}
{"level":"info","ts":"2026-07-12T17:49:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3870a0bd1a0a97384fa467572a11f3e02bf8a38a9d98723ef83a08c988962d32"}
{"level":"info","ts":"2026-07-12T17:49:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/98d83a974a5836b9d16ec8635ad8fa6bf5d47473a669515ffd6a98c2ff0e5eac"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9de63cf6884823a39c2ec2f79049ba9bd3227decf3c95c05f8b6d963d04af2e"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99e71363b711e50fbec5d7777fe6b0fc295fb734825c66d3267872dea96bd07f"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8704cfd0632d82d1c8c0b1eebf1ebede066b2c1b57582608e84c1b94adf6072"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/984fd75a65a0e77415b063290b2abc1daa53af714b9533ddee01b1c43145358f"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e1b3bf3b52cd0d0f6ab483cfa3ccf8ad433ddefd74390fc72b7a969850a0c3b"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ef053e69c78e9863c84592ca3707d0ffe3a2cd32717b1f232b8a0f1380c32ce"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85d14f21d9367f3228e484977cef8644720e80f9eaf3106a764e194460a1c982"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e1ba5aa45d8dfe56fdda674513b6d4ca962ab16bf8434d558834be00a8574ff7"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8043f6aaabd3940b6eefd261e1505fa985cf67695a124037ed5ae0e39c36c61d"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe067611c0b9207ddfc214509838608d5dc95606a0776fb167b502c11223fa79"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1762d6ef756701a27e0549c283bbfc5f66432bdc3192fdfe34f1e27fcf832352"}
{"level":"info","ts":"2026-07-12T17:49:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9bdc292a00872a5fa01b862039e407ab95ff4c9ac1bb4b3ee8437b49d8ccd5b"}
{"level":"info","ts":"2026-07-12T17:50:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2470e50fa5bfaa8ee384f273179da8cfc447b6cf809884965dd546f8ccc3dd6b"}
{"level":"info","ts":"2026-07-12T17:50:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9194712a517886f72a10e4d8f14af7818866e40ec5a823586d546b011036c713"}
{"level":"info","ts":"2026-07-12T17:50:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71210242ee9ed9be15b55eff2fe2874ee53af8479921d1ab7160fbfc479c7f5e"}
{"level":"info","ts":"2026-07-12T17:50:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/97c3dfba06711beb6782c4c187b038fb8d8748001c4029d910c807ffff303f20"}
{"level":"info","ts":"2026-07-12T17:50:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/174dec1fe9de01996bf7066e3d3bdce3ad7dc6de706f2cdc26c7aac48382c1e7"}
{"level":"info","ts":"2026-07-12T17:50:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/894cfaf2fef166c36620130799bdafd9c6d9e7d82911b386ca22fb19c756a073"}
{"level":"info","ts":"2026-07-12T17:50:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aeaeeddfba5e4947acf795be2b24a99416d1ed3cf84973e9f9d5ef457c3431dc"}
{"level":"info","ts":"2026-07-12T17:50:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f742118059d0bf2535a029a8f62442c4d3cf638b05ef7f4ab5364f7daa73c867"}