{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad8ec6fcaae367a0f1be7791692160ac0dbad82a820883190bca727a20f81c91"}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad8ec6fcaae367a0f1be7791692160ac0dbad82a820883190bca727a20f81c91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e"}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e"}
{"level":"error","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"error","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"}
{"level":"debug","ts":"2026-07-06T23:03:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:03:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:56Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2dc9e14ed443839aab9ef40a9973ad605a4d923e4722b2967a5b0516b6f28541","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:03:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2dc9e14ed443839aab9ef40a9973ad605a4d923e4722b2967a5b0516b6f28541"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"122c2b9273db2c1ab95504acde6726765151655a99f5ef30f95d4d5c5ca2704f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/122c2b9273db2c1ab95504acde6726765151655a99f5ef30f95d4d5c5ca2704f"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1233bfe08733ff5189bda3ccf90dcf08634d270eb1823bd4674abc945dccee04","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654"}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1233bfe08733ff5189bda3ccf90dcf08634d270eb1823bd4674abc945dccee04"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad8ec6fcaae367a0f1be7791692160ac0dbad82a820883190bca727a20f81c91","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6e636dd019b6b148cae0ce0f2d15a5b62e81fbc69c3125dc3b716b69f2d8895","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad8ec6fcaae367a0f1be7791692160ac0dbad82a820883190bca727a20f81c91"}
{"level":"info","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6e636dd019b6b148cae0ce0f2d15a5b62e81fbc69c3125dc3b716b69f2d8895"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"75161a5624ee781732debbde0be3690be714fe769808cd3c45efa23ee9c3abf4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"08fa463cb056054ba96e8eea526dccc6ab0b957e04ecfbb9ee3ca63cfeab2bd8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1f54522b52af15b033c911eb25fb6cc642162ff544dfc4d544713e6b7d45df4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T23:03:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/75161a5624ee781732debbde0be3690be714fe769808cd3c45efa23ee9c3abf4"}
{"level":"error","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa324d4f8a26bfded959dfecfa381637d9e2534dcab89e70d9523a41a41c202d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/08fa463cb056054ba96e8eea526dccc6ab0b957e04ecfbb9ee3ca63cfeab2bd8"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1f54522b52af15b033c911eb25fb6cc642162ff544dfc4d544713e6b7d45df4e"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa324d4f8a26bfded959dfecfa381637d9e2534dcab89e70d9523a41a41c202d"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"12f75eb72bce0dc89cf093bad1c8c0c1e8787b158466e64f6828db5573f5a4a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9bef9f61bfde4fdd388f863f3b1efdfef33848eeb116f4d6adbb01c93e045a7d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12f75eb72bce0dc89cf093bad1c8c0c1e8787b158466e64f6828db5573f5a4a6"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9bef9f61bfde4fdd388f863f3b1efdfef33848eeb116f4d6adbb01c93e045a7d"}
{"level":"debug","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0473e1cb08de2544268a4f86eabf9a153dfd87f514ab8ab5b86764d56ad73cf4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"}
{"level":"info","ts":"2026-07-06T23:03:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0473e1cb08de2544268a4f86eabf9a153dfd87f514ab8ab5b86764d56ad73cf4"}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149d267d-4562-4858-a9a2-a52dafca9714","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38360","PortSpecifier":{"PortValue":38360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"149d267d-4562-4858-a9a2-a52dafca9714","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"149d267d-4562-4858-a9a2-a52dafca9714","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38360","PortSpecifier":{"PortValue":38360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379039,"nanos":764435603},"http":{"id":"149d267d-4562-4858-a9a2-a52dafca9714","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"149d267d-4562-4858-a9a2-a52dafca9714","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"037c63e2-5e43-46a0-9163-d222072c3762","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"]}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"149d267d-4562-4858-a9a2-a52dafca9714","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"037c63e2-5e43-46a0-9163-d222072c3762","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c6e636dd019b6b148cae0ce0f2d15a5b62e81fbc69c3125dc3b716b69f2d8895"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"149d267d-4562-4858-a9a2-a52dafca9714","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149d267d-4562-4858-a9a2-a52dafca9714","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"149d267d-4562-4858-a9a2-a52dafca9714","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4676640a-b74a-437e-be50-62049aba4d93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51684","PortSpecifier":{"PortValue":51684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4676640a-b74a-437e-be50-62049aba4d93","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4676640a-b74a-437e-be50-62049aba4d93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:51684","PortSpecifier":{"PortValue":51684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379039,"nanos":805506648},"http":{"id":"4676640a-b74a-437e-be50-62049aba4d93","method":"POST","headers":{":authority":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4676640a-b74a-437e-be50-62049aba4d93","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"037c63e2-5e43-46a0-9163-d222072c3762","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"]}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4676640a-b74a-437e-be50-62049aba4d93","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"037c63e2-5e43-46a0-9163-d222072c3762","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"12f75eb72bce0dc89cf093bad1c8c0c1e8787b158466e64f6828db5573f5a4a6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4676640a-b74a-437e-be50-62049aba4d93","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4676640a-b74a-437e-be50-62049aba4d93","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4676640a-b74a-437e-be50-62049aba4d93","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"804d94e2-3839-432b-9a66-895a63656693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38376","PortSpecifier":{"PortValue":38376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"804d94e2-3839-432b-9a66-895a63656693","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"804d94e2-3839-432b-9a66-895a63656693","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38376","PortSpecifier":{"PortValue":38376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379039,"nanos":845132935},"http":{"id":"804d94e2-3839-432b-9a66-895a63656693","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"804d94e2-3839-432b-9a66-895a63656693","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf\"}"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","subscription":"e2e-rate-iso-a-c26512","tenant":"e2e-shared-a-c8326f","userId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"804d94e2-3839-432b-9a66-895a63656693","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-c26512\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"804d94e2-3839-432b-9a66-895a63656693","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c26512"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"804d94e2-3839-432b-9a66-895a63656693","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","selected_subscription":"e2e-rate-iso-a-c26512","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-c26512@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"804d94e2-3839-432b-9a66-895a63656693","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:03:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"804d94e2-3839-432b-9a66-895a63656693","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38378","PortSpecifier":{"PortValue":38378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38378","PortSpecifier":{"PortValue":38378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379040,"nanos":894263149},"http":{"id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf\"}"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","subscription":"e2e-rate-iso-a-c26512","tenant":"e2e-shared-a-c8326f","userId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-c26512\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c26512"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","selected_subscription":"e2e-rate-iso-a-c26512","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-c26512@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b4a6d0c-fd3b-451a-91b0-7743f84dcf0f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59764","PortSpecifier":{"PortValue":59764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59764","PortSpecifier":{"PortValue":59764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379041,"nanos":938760235},"http":{"id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1736tEguyURAqX884_fJHmHTbVWj7VNlebO2J3tss2h4KXw2nQof6ZJNnDtkf\"}"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","subscription":"e2e-rate-iso-a-c26512","tenant":"e2e-shared-a-c8326f","userId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-c26512\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-c26512"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"03265301-f584-4b19-bbbd-7ff7ee41ecbc","keyName":"e2e-rate-a-c26512","selected_subscription":"e2e-rate-iso-a-c26512","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-c26512@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-c26512","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef9f0fc-f137-4e72-8f74-48dd82ec664d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59774","PortSpecifier":{"PortValue":59774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98f08c4c-1050-4221-aecb-40ab12817ace","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59774","PortSpecifier":{"PortValue":59774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379048,"nanos":487626484},"http":{"id":"98f08c4c-1050-4221-aecb-40ab12817ace","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"037c63e2-5e43-46a0-9163-d222072c3762","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"]}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"037c63e2-5e43-46a0-9163-d222072c3762","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"c6e636dd019b6b148cae0ce0f2d15a5b62e81fbc69c3125dc3b716b69f2d8895"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98f08c4c-1050-4221-aecb-40ab12817ace","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54188","PortSpecifier":{"PortValue":54188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:54188","PortSpecifier":{"PortValue":54188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379048,"nanos":524880971},"http":{"id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","method":"POST","headers":{":authority":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"037c63e2-5e43-46a0-9163-d222072c3762","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"]}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b03b08b86b4c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fb61558a-d084-452d-9e40-d64133c74cef"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"037c63e2-5e43-46a0-9163-d222072c3762","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"12f75eb72bce0dc89cf093bad1c8c0c1e8787b158466e64f6828db5573f5a4a6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.40:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"684c9620-46b6-4250-88a7-d7d7cac66aa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59784","PortSpecifier":{"PortValue":59784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"87c84191-ac5a-464f-baad-3de68b79ae18","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59784","PortSpecifier":{"PortValue":59784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379048,"nanos":561931804},"http":{"id":"87c84191-ac5a-464f-baad-3de68b79ae18","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"87c84191-ac5a-464f-baad-3de68b79ae18","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59790","PortSpecifier":{"PortValue":59790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54d19214-118b-44ac-8c55-770c7cffb86b","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59790","PortSpecifier":{"PortValue":59790}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379049,"nanos":600723996},"http":{"id":"54d19214-118b-44ac-8c55-770c7cffb86b","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54d19214-118b-44ac-8c55-770c7cffb86b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59798","PortSpecifier":{"PortValue":59798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c3dc0df-a422-469c-abde-078c2d28ee91","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:59798","PortSpecifier":{"PortValue":59798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379050,"nanos":638162287},"http":{"id":"7c3dc0df-a422-469c-abde-078c2d28ee91","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c3dc0df-a422-469c-abde-078c2d28ee91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51a98523-7138-479a-b494-71b1e3441de9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44872","PortSpecifier":{"PortValue":44872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"51a98523-7138-479a-b494-71b1e3441de9","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51a98523-7138-479a-b494-71b1e3441de9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44872","PortSpecifier":{"PortValue":44872}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379051,"nanos":673036972},"http":{"id":"51a98523-7138-479a-b494-71b1e3441de9","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"51a98523-7138-479a-b494-71b1e3441de9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51a98523-7138-479a-b494-71b1e3441de9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51a98523-7138-479a-b494-71b1e3441de9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51a98523-7138-479a-b494-71b1e3441de9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44874","PortSpecifier":{"PortValue":44874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44874","PortSpecifier":{"PortValue":44874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379052,"nanos":714127516},"http":{"id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1aaf3db-08fb-4e24-b8f3-5badaf2ddb0c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44890","PortSpecifier":{"PortValue":44890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44890","PortSpecifier":{"PortValue":44890}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379053,"nanos":752868362},"http":{"id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2d77dd6-6b31-4a72-bd67-78e88493e0be","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44894","PortSpecifier":{"PortValue":44894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5ae077ae-b0f6-484c-9244-6b0150871f52","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44894","PortSpecifier":{"PortValue":44894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379054,"nanos":792376981},"http":{"id":"5ae077ae-b0f6-484c-9244-6b0150871f52","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ae077ae-b0f6-484c-9244-6b0150871f52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44906","PortSpecifier":{"PortValue":44906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e254b647-54b3-4ad9-8801-08887a8f43d5","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44906","PortSpecifier":{"PortValue":44906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379055,"nanos":829333158},"http":{"id":"e254b647-54b3-4ad9-8801-08887a8f43d5","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e254b647-54b3-4ad9-8801-08887a8f43d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44914","PortSpecifier":{"PortValue":44914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44914","PortSpecifier":{"PortValue":44914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379056,"nanos":863903736},"http":{"id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9385f65-2059-4d65-a65b-a65d8ae0a845","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44928","PortSpecifier":{"PortValue":44928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5906ec39-1938-49ef-aad1-c072fb92dd05","method":"POST","path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions","host":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44928","PortSpecifier":{"PortValue":44928}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379057,"nanos":900274512},"http":{"id":"5906ec39-1938-49ef-aad1-c072fb92dd05","method":"POST","headers":{":authority":"e2e-shared-a-c8326f.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2SKEKvzDC4mO3lWM_Tpz3ImKrjqqwkbGmKmfqlCsezPi64vq0b0CnYeJ0N6k\"}"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","subscription":"e2e-rate-iso-a-856a8d","tenant":"e2e-shared-a-c8326f","userId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\",\"requestedSubscription\":\"e2e-rate-iso-a-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c8326f.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3133db0a-f439-4ffd-81ea-a6ef80ea6440","keyName":"e2e-rate-a-856a8d","selected_subscription":"e2e-rate-iso-a-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-a-c8326f/e2e-rate-iso-a-856a8d@ai-tenant-e2e-shared-a-c8326f/rate-test-model-c8326f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c8326f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-856a8d","namespace":"ai-tenant-e2e-shared-a-c8326f","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5906ec39-1938-49ef-aad1-c072fb92dd05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39380","PortSpecifier":{"PortValue":39380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97c85a46-f65c-428b-b50f-f163b56c9049","method":"POST","path":"/ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62/v1/completions","host":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39380","PortSpecifier":{"PortValue":39380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.40:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783379057,"nanos":936323315},"http":{"id":"97c85a46-f65c-428b-b50f-f163b56c9049","method":"POST","headers":{":authority":"e2e-shared-b-b0de62.apps.4ab57f57-61ab-4162-bdba-b03b08b86b4c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YHSvfVzGv4c9gPRU_bruoCDnBFQ6ud0EFRuiU4BYNT3bjKLCM5XQgxgj4uOi"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b0de62.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YHSvfVzGv4c9gPRU_bruoCDnBFQ6ud0EFRuiU4BYNT3bjKLCM5XQgxgj4uOi\"}"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b0de62.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"336dabc4-5160-4ea6-9da6-a7350410010a","keyName":"e2e-rate-b-856a8d","subscription":"e2e-rate-iso-b-856a8d","tenant":"e2e-shared-b-b0de62","userId":"336dabc4-5160-4ea6-9da6-a7350410010a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b0de62.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62\",\"requestedSubscription\":\"e2e-rate-iso-b-856a8d\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b0de62.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b0de62","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-856a8d","namespace":"ai-tenant-e2e-shared-b-b0de62","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-856a8d"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"336dabc4-5160-4ea6-9da6-a7350410010a","keyName":"e2e-rate-b-856a8d","selected_subscription":"e2e-rate-iso-b-856a8d","selected_subscription_key":"ai-tenant-e2e-shared-b-b0de62/e2e-rate-iso-b-856a8d@ai-tenant-e2e-shared-b-b0de62/rate-test-model-b0de62","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b0de62","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-856a8d","namespace":"ai-tenant-e2e-shared-b-b0de62","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T23:04:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97c85a46-f65c-428b-b50f-f163b56c9049","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T23:04:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e133f6df6af8440e3000ad257b2d7b462db80c0cacfb68bfcaf25b4794f8a8cd"}
{"level":"info","ts":"2026-07-06T23:04:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6e242912bd5909215f44f358dbf7767186927a10a2e025fc54fa7d821a133654"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/08fa463cb056054ba96e8eea526dccc6ab0b957e04ecfbb9ee3ca63cfeab2bd8"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2954ec3fe3b98cfb6282b9961d61ef6af4a1dd0ebfdbb59708ddf58db8cbc6e"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/03059280d89ecf737e4ae4b76534300e3e50e3c47b118d3c494ef622b1b3b53e"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1233bfe08733ff5189bda3ccf90dcf08634d270eb1823bd4674abc945dccee04"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/75161a5624ee781732debbde0be3690be714fe769808cd3c45efa23ee9c3abf4"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa324d4f8a26bfded959dfecfa381637d9e2534dcab89e70d9523a41a41c202d"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/040de484fcd4fdf3c8df19eaf3fd5702d64d7afcb171d4b3f89ac4c925fd1c5f"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad8ec6fcaae367a0f1be7791692160ac0dbad82a820883190bca727a20f81c91"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/029161404a1dc8d41bcf6b7001b31efd76e7fce933b18210e3c6a005e99a67ab"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0473e1cb08de2544268a4f86eabf9a153dfd87f514ab8ab5b86764d56ad73cf4"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9bef9f61bfde4fdd388f863f3b1efdfef33848eeb116f4d6adbb01c93e045a7d"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9aef095c59dd2df45004a5145fc6c7795e70f019168922c87655ccb153d0280d"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1f54522b52af15b033c911eb25fb6cc642162ff544dfc4d544713e6b7d45df4e"}
{"level":"info","ts":"2026-07-06T23:04:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f5e233d02fc9354e79f3df28a72cab3a3c054758afb9e2551b24451b8b29344"}
{"level":"info","ts":"2026-07-06T23:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2dc9e14ed443839aab9ef40a9973ad605a4d923e4722b2967a5b0516b6f28541"}
{"level":"info","ts":"2026-07-06T23:04:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6e636dd019b6b148cae0ce0f2d15a5b62e81fbc69c3125dc3b716b69f2d8895"}
{"level":"info","ts":"2026-07-06T23:05:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/12f75eb72bce0dc89cf093bad1c8c0c1e8787b158466e64f6828db5573f5a4a6"}
{"level":"info","ts":"2026-07-06T23:05:07Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/122c2b9273db2c1ab95504acde6726765151655a99f5ef30f95d4d5c5ca2704f"}