{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-10FjADNavouX1wNCV_Vu5r3OlAsDsQe3wtKQCo3vScMwGdxwH3phAKENW6pzC"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-10FjADNavouX1wNCV_Vu5r3OlAsDsQe3wtKQCo3vScMwGdxwH3phAKENW6pzC\"}"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e418b1e9-9199-410d-8e0e-23b6390175f4","keyName":"e2e-rate-a-785f63","subscription":"e2e-rate-iso-a-785f63","tenant":"e2e-shared-a-67d68f","userId":"e418b1e9-9199-410d-8e0e-23b6390175f4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-785f63\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-785f63","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-785f63"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e418b1e9-9199-410d-8e0e-23b6390175f4","keyName":"e2e-rate-a-785f63","selected_subscription":"e2e-rate-iso-a-785f63","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-785f63@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-785f63","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a736b572-35cc-4799-9ae7-202bb4c8b348","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33488","PortSpecifier":{"PortValue":33488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74f688b7-52b0-42e8-b978-e93d18954bb0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33488","PortSpecifier":{"PortValue":33488}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245002,"nanos":875175508},"http":{"id":"74f688b7-52b0-42e8-b978-e93d18954bb0","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"]}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"119af1afa42f6d64d911d976e47cc886efc921a9aa2fc0f07e7db8d34a8c26ce"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74f688b7-52b0-42e8-b978-e93d18954bb0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57604","PortSpecifier":{"PortValue":57604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.71:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-827464.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57604","PortSpecifier":{"PortValue":57604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.71:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245002,"nanos":914477287},"http":{"id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","method":"POST","headers":{":authority":"e2e-shared-b-827464.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"]}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bc54acaa0313eaa8a03fed5edf87481173839b863f7fa7414be109b810af0f43"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.71:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-827464.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-827464/rate-test-model-827464\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-827464/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f981109a-b7d9-43b9-a0e1-732ce0a75044","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33492","PortSpecifier":{"PortValue":33492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33492","PortSpecifier":{"PortValue":33492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245002,"nanos":953314995},"http":{"id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"10cc7a11-7df6-4ab8-a557-dd895c9f226c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"337d56e6-5604-4c72-92a3-a19488587070","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33506","PortSpecifier":{"PortValue":33506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"337d56e6-5604-4c72-92a3-a19488587070","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"337d56e6-5604-4c72-92a3-a19488587070","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33506","PortSpecifier":{"PortValue":33506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245003,"nanos":996162302},"http":{"id":"337d56e6-5604-4c72-92a3-a19488587070","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"337d56e6-5604-4c72-92a3-a19488587070","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"337d56e6-5604-4c72-92a3-a19488587070","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"337d56e6-5604-4c72-92a3-a19488587070","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"337d56e6-5604-4c72-92a3-a19488587070","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33522","PortSpecifier":{"PortValue":33522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33522","PortSpecifier":{"PortValue":33522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245005,"nanos":35672132},"http":{"id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7f3ccce-e26d-401d-b728-46b199e3f3f5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33534","PortSpecifier":{"PortValue":33534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33534","PortSpecifier":{"PortValue":33534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245006,"nanos":75252477},"http":{"id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3413ee48-b9d4-4fcd-9b16-0c2ab737b517","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33540","PortSpecifier":{"PortValue":33540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:33540","PortSpecifier":{"PortValue":33540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245007,"nanos":118920442},"http":{"id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"09ecd906-0b62-4d5f-a0e0-844851c2b409","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29954dff-8273-4dbb-a009-5687805f75bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40536","PortSpecifier":{"PortValue":40536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29954dff-8273-4dbb-a009-5687805f75bc","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29954dff-8273-4dbb-a009-5687805f75bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40536","PortSpecifier":{"PortValue":40536}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245008,"nanos":156888788},"http":{"id":"29954dff-8273-4dbb-a009-5687805f75bc","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29954dff-8273-4dbb-a009-5687805f75bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29954dff-8273-4dbb-a009-5687805f75bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29954dff-8273-4dbb-a009-5687805f75bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29954dff-8273-4dbb-a009-5687805f75bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"126b5d97-0106-46a2-abad-0a09328304a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40540","PortSpecifier":{"PortValue":40540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"126b5d97-0106-46a2-abad-0a09328304a9","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"126b5d97-0106-46a2-abad-0a09328304a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40540","PortSpecifier":{"PortValue":40540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245009,"nanos":201677655},"http":{"id":"126b5d97-0106-46a2-abad-0a09328304a9","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"126b5d97-0106-46a2-abad-0a09328304a9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"126b5d97-0106-46a2-abad-0a09328304a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"126b5d97-0106-46a2-abad-0a09328304a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"126b5d97-0106-46a2-abad-0a09328304a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40548","PortSpecifier":{"PortValue":40548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","method":"POST","path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions","host":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40548","PortSpecifier":{"PortValue":40548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245010,"nanos":239851306},"http":{"id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","method":"POST","headers":{":authority":"e2e-shared-a-67d68f.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-POTtje3GU5PlDC2u_nuc2AWoRqr5qrcLP2YcHNVZpMwAJgsTmrbrD7fcsb0G\"}"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","subscription":"e2e-rate-iso-a-292845","tenant":"e2e-shared-a-67d68f","userId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\",\"requestedSubscription\":\"e2e-rate-iso-a-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-67d68f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-292845"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"fa77bf13-4601-4f4a-b261-4fe2a2f653dd","keyName":"e2e-rate-a-292845","selected_subscription":"e2e-rate-iso-a-292845","selected_subscription_key":"ai-tenant-e2e-shared-a-67d68f/e2e-rate-iso-a-292845@ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-67d68f/models/facebook/opt-125m","name":"rate-test-model-67d68f","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-292845","namespace":"ai-tenant-e2e-shared-a-67d68f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-67d68f/rate-test-model-67d68f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc8bf443-bd6e-49ec-973e-edaae34f0a58","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56900","PortSpecifier":{"PortValue":56900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.71:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","method":"POST","path":"/ai-tenant-e2e-shared-b-827464/rate-test-model-827464/v1/completions","host":"e2e-shared-b-827464.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:56900","PortSpecifier":{"PortValue":56900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.71:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245010,"nanos":276582202},"http":{"id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","method":"POST","headers":{":authority":"e2e-shared-b-827464.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-827464/rate-test-model-827464/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Vfe66ozs5L0DGz5Z_IzRy14J2fneDjwSWvunI7AD4mMHZ0gVo90wZzP30cM0"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-827464.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Vfe66ozs5L0DGz5Z_IzRy14J2fneDjwSWvunI7AD4mMHZ0gVo90wZzP30cM0\"}"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-827464.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"eb5fe7f8-c459-4120-bfb6-6dba0bed6125","keyName":"e2e-rate-b-292845","subscription":"e2e-rate-iso-b-292845","tenant":"e2e-shared-b-827464","userId":"eb5fe7f8-c459-4120-bfb6-6dba0bed6125","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-827464.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-827464/rate-test-model-827464\",\"requestedSubscription\":\"e2e-rate-iso-b-292845\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-827464.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-827464/models/facebook/opt-125m","name":"rate-test-model-827464","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-292845","namespace":"ai-tenant-e2e-shared-b-827464","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-827464/rate-test-model-827464"}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-827464/rate-test-model-827464\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-827464/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-292845"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"eb5fe7f8-c459-4120-bfb6-6dba0bed6125","keyName":"e2e-rate-b-292845","selected_subscription":"e2e-rate-iso-b-292845","selected_subscription_key":"ai-tenant-e2e-shared-b-827464/e2e-rate-iso-b-292845@ai-tenant-e2e-shared-b-827464/rate-test-model-827464","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-827464/models/facebook/opt-125m","name":"rate-test-model-827464","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-292845","namespace":"ai-tenant-e2e-shared-b-827464","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-827464/rate-test-model-827464"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:23:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d353aae-515b-4fcf-8f4e-4e5d4a8256f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/968c3cfe687277efc0c8fb532e2d34bb0b8c0cd9d18d71baa064552a74ecc5f1"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6a15541e83d33e97e1a3563f16e827ff300c5a5365762534d5e7038a911c847"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b0c84e1b9ce9c7c2a9c8e0b93a353f64b15ac31fd119c8733203505c47de8562"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85d8a53cbe23f189adb01248146c54a20fbf788ff4b58e34ad6d5a2ba04188f4"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/38af00a8aef24215cf5a73500f89733375b94fc21acd054f9bb8ab0ad25d3e4f"}
{"level":"info","ts":"2026-07-28T13:23:35Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad55254dae521b9bc20ce909c4f3250362fb4f60868edbdf9e0b49274239f650"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2d933f22422e1e9440d8709188b481a4f994919d620ed65e1136c9dfadbd71a7"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5f89bbbf36528ffbe31ac208ea9bcf3f6cc7f3a08954fc4b0991af49dbf70f7"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f32678189e003b59ee94073c431cd198a29a29a566643b979cee6b8a74d27b1"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76f319d5ca428659ab11de126811d4687191e474ee2d371b54770b6d2c335d26"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2dec878d3890b156e278fd05157a323f62f9eb15f4cb943a613993821e8ad05"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e93cb4f339dc015cf70a095217ef89d4b6e5f6d6ad7db2f02eed549cbad0e818"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5afccea294e85bfa4fe9fea222b10c6f3ff4b2dcf10b1b8a9c3c8b6d922cff23"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f327048a3301fc574965e90beeeb042f4113452036e51f7914520b4ae47e4f32"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/119af1afa42f6d64d911d976e47cc886efc921a9aa2fc0f07e7db8d34a8c26ce"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc54acaa0313eaa8a03fed5edf87481173839b863f7fa7414be109b810af0f43"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/389ac1877521c6fee2188d4204b2c0daf7bfa41e54ae48cd71b28f45e690b16f"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1795c30449c8939528518920578ad9a246c7e334419b4a637ad84fb65cf88820"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ecbd738f5eac855284a593e440da137bf65e0c7c0bd1ffee8abb4ca69bfd6f8f"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b018f624e020f051afdabc7c2bb404469e0533256fee94af449697038b0bbdd6"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f05314559011d7112a17ec220392614609e62c1d199642906dcd28a93e45a9ed"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e5d4fda0d8b4687039f7284f67334010b50ecaf6006497cd64f63eeba2163b9"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/977a443d4df53a60c7945e8d69f5613e8b019f00099d98a8dfdda9cd310fe52e"}
{"level":"info","ts":"2026-07-28T13:23:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7132eb2d7022fc2d305b1ae7250388803bd12540598c4534e3cb8e648352a98"}
{"level":"info","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60074","PortSpecifier":{"PortValue":60074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60074","PortSpecifier":{"PortValue":60074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245072,"nanos":890180034},"http":{"id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","method":"POST","headers":{":authority":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"]}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f0ee504-e55f-48a9-8ad9-df546dfb23c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60076","PortSpecifier":{"PortValue":60076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ea79416-6c68-442c-ac57-0a19e96147f1","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60076","PortSpecifier":{"PortValue":60076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245072,"nanos":945760373},"http":{"id":"9ea79416-6c68-442c-ac57-0a19e96147f1","method":"POST","headers":{":authority":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G8EGZ1FYR5nJsKMK_qJlUy2xo7YGGnORB7iGldGfHOpIQkmU6WtNticXte66"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G8EGZ1FYR5nJsKMK_qJlUy2xo7YGGnORB7iGldGfHOpIQkmU6WtNticXte66\"}"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"187fb16e-299c-4e7f-9fa4-57a9a31a9d36","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"187fb16e-299c-4e7f-9fa4-57a9a31a9d36","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"187fb16e-299c-4e7f-9fa4-57a9a31a9d36","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ea79416-6c68-442c-ac57-0a19e96147f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e"}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57"}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e"}
{"level":"info","ts":"2026-07-28T13:24:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"}
{"level":"info","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:24:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:24:59Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb"}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332"}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c"}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T13:25:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332"}
{"level":"info","ts":"2026-07-28T13:25:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c"}
{"level":"info","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55656","PortSpecifier":{"PortValue":55656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-8fb56b.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:55656","PortSpecifier":{"PortValue":55656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245117,"nanos":921384813},"http":{"id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","method":"POST","headers":{":authority":"e2e-ipp-a-8fb56b.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"]}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/62ca0f1aac10"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0ea57d71-451c-43e5-9695-1e4c47fba261"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"68291b13-2c09-46e2-9a2f-6abbc3bc3a51","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.80:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-8fb56b.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-8fb56b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:25:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c1e735c-788e-4cbd-be24-b6051bfe48e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40916","PortSpecifier":{"PortValue":40916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","method":"POST","path":"/ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b/v1/chat/completions","host":"e2e-ipp-a-8fb56b.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:40916","PortSpecifier":{"PortValue":40916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785245119,"nanos":985275785},"http":{"id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","method":"POST","headers":{":authority":"e2e-ipp-a-8fb56b.apps.16f867de-7aa5-47be-9446-62ca0f1aac10.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KFszl3PaMifhpnEo_mSDKq4cZuZeFy2yaHyJLHXxp6dItSLOgyDbqK2i1L8c"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-8fb56b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KFszl3PaMifhpnEo_mSDKq4cZuZeFy2yaHyJLHXxp6dItSLOgyDbqK2i1L8c\"}"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-8fb56b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"29773633-19a2-4a78-b065-af1a104d7a61","keyName":"e2e-ipp-8fb56b","subscription":"ipp-route-8fb56b-sub","tenant":"e2e-ipp-a-8fb56b","userId":"29773633-19a2-4a78-b065-af1a104d7a61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-8fb56b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b\",\"requestedSubscription\":\"ipp-route-8fb56b-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-8fb56b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-8fb56b/models/facebook/opt-125m","name":"ipp-route-8fb56b","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-8fb56b-sub","namespace":"ai-tenant-e2e-ipp-a-8fb56b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b"}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-8fb56b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-8fb56b-sub"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"29773633-19a2-4a78-b065-af1a104d7a61","keyName":"e2e-ipp-8fb56b","selected_subscription":"ipp-route-8fb56b-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b-sub@ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-8fb56b/models/facebook/opt-125m","name":"ipp-route-8fb56b","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-8fb56b-sub","namespace":"ai-tenant-e2e-ipp-a-8fb56b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-8fb56b/ipp-route-8fb56b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T13:25:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48e89722-cbcf-49ec-b3e7-d86874c9f431","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T13:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2780a65df69c1ff8ba64b97fff8301b2d7b91da578a62f93817905f6ca60a903"}
{"level":"info","ts":"2026-07-28T13:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d22d4c47a392cade7d459e133bc2aa99d4d1efe49248ec6a1e9e7383a256929"}
{"level":"info","ts":"2026-07-28T13:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f35cf9fb04b59f1ebfea3aa1ef05550bd872bf28e999ce347bec8be1bd7eca1f"}
{"level":"info","ts":"2026-07-28T13:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0acc1d0d8543cadd8bd06e8e7374432467d13d11d85cd8aff87f0a78bed5335c"}
{"level":"info","ts":"2026-07-28T13:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e8c0b4ccd25a7b9f6ff4f780f80e64b9f3cb50d1648933ff142401588ede00e"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24e50c273ae25d49a6f3bb78f241626f5ed908c497ed1e8247d64204e8dd5baa"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8a1be53e1b20e6d59805ab98c654cb3ceec28ee17684e650e89f49b39417207"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a244ca6972a93edef786aac12b8c1964faec690c618f4f18ffa729943e264fa1"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0f15b9f7dd28025c1d3ed117905a8dcb86555ac9977c879462edb2f178dfdfeb"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86785ed9fc535aa9060b4c16f04875c5a484105182bf9e1c28bc2d586a92ea57"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc1975fd1045e17e6a7973fe33983d21feb6e5239459c262f01d68f3f807588e"}
{"level":"info","ts":"2026-07-28T13:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7c4c9fa84b0f07e6f0b5cbd0d60fcc373f745bf43d6bcde6aca9ba1e81c5b332"}