{"level":"debug","ts":"2026-07-24T14:19:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb8b8d989fb3f9f9eae59fe37b60737eab7cfa9c4d88ffc9275a277ebc2eeede","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:19:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb8b8d989fb3f9f9eae59fe37b60737eab7cfa9c4d88ffc9275a277ebc2eeede","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44958","PortSpecifier":{"PortValue":44958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44958","PortSpecifier":{"PortValue":44958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902777,"nanos":583603832},"http":{"id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"1a599b706f0f0c009b5017960c48e44accfafa84c78936745707481fde58130b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"abbb4767-ca6c-41af-8447-bc7ddd75e865","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53572","PortSpecifier":{"PortValue":53572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:53572","PortSpecifier":{"PortValue":53572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902777,"nanos":624432349},"http":{"id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","method":"POST","headers":{":authority":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f80d35fb76b8d6687d2fe9d619fa18c6c986a929369c2de63fafa9d952849e2d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-525009/rate-test-model-525009\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-525009/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e0d054d-8e86-44e0-952c-41e0fececdd3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44974","PortSpecifier":{"PortValue":44974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44974","PortSpecifier":{"PortValue":44974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902777,"nanos":662907452},"http":{"id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fb4a66d-f3dd-4538-a749-bbcdab94173f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44984","PortSpecifier":{"PortValue":44984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44984","PortSpecifier":{"PortValue":44984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902778,"nanos":750668756},"http":{"id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5070937-bebe-4a92-b7ca-e4be0e5ea48a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44986","PortSpecifier":{"PortValue":44986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44986","PortSpecifier":{"PortValue":44986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902779,"nanos":788172410},"http":{"id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f7789f3c-0d38-4a4f-ae2e-330256754b09","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44990","PortSpecifier":{"PortValue":44990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44990","PortSpecifier":{"PortValue":44990}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902780,"nanos":829779486},"http":{"id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b9e65f7-22db-4302-89a4-f4c09aa53972","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:45002","PortSpecifier":{"PortValue":45002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:45002","PortSpecifier":{"PortValue":45002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902781,"nanos":870622504},"http":{"id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a84efcc8-a11d-44a3-8ae5-364c48b17202","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38634","PortSpecifier":{"PortValue":38634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4b7b7d2-0ea6-4481-aae0-962363413545","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38634","PortSpecifier":{"PortValue":38634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902782,"nanos":912881184},"http":{"id":"a4b7b7d2-0ea6-4481-aae0-962363413545","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4b7b7d2-0ea6-4481-aae0-962363413545","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38648","PortSpecifier":{"PortValue":38648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"732b438e-3a7c-420d-bc59-be6b73abdf83","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38648","PortSpecifier":{"PortValue":38648}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902783,"nanos":949189631},"http":{"id":"732b438e-3a7c-420d-bc59-be6b73abdf83","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"732b438e-3a7c-420d-bc59-be6b73abdf83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38656","PortSpecifier":{"PortValue":38656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7feb069-895b-44e7-8a48-de6d40d4082e","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:38656","PortSpecifier":{"PortValue":38656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902784,"nanos":987922770},"http":{"id":"a7feb069-895b-44e7-8a48-de6d40d4082e","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1UfT1dct9XO1zsdcE_5SnKkbpsGSw26rhl5wuX9FDbARcGhTJmP6nPzxOpQBc\"}"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","subscription":"e2e-rate-iso-a-d34c68","tenant":"e2e-shared-a-4cd364","userId":"3027a150-c492-456f-9f4c-da2eff1f8f65","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-d34c68\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-d34c68"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3027a150-c492-456f-9f4c-da2eff1f8f65","keyName":"e2e-rate-a-d34c68","selected_subscription":"e2e-rate-iso-a-d34c68","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-d34c68@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-d34c68","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7feb069-895b-44e7-8a48-de6d40d4082e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55970","PortSpecifier":{"PortValue":55970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55970","PortSpecifier":{"PortValue":55970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902793,"nanos":995051810},"http":{"id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"1a599b706f0f0c009b5017960c48e44accfafa84c78936745707481fde58130b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d78f146b-8b47-425d-8305-70a6ff0e7fd7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34922","PortSpecifier":{"PortValue":34922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a640054e-c821-4177-bd81-4d3c970b9c80","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34922","PortSpecifier":{"PortValue":34922}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902794,"nanos":36171104},"http":{"id":"a640054e-c821-4177-bd81-4d3c970b9c80","method":"POST","headers":{":authority":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f80d35fb76b8d6687d2fe9d619fa18c6c986a929369c2de63fafa9d952849e2d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-525009/rate-test-model-525009\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-525009/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a640054e-c821-4177-bd81-4d3c970b9c80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55982","PortSpecifier":{"PortValue":55982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55982","PortSpecifier":{"PortValue":55982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902794,"nanos":69682340},"http":{"id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g\"}"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","subscription":"e2e-rate-iso-a-2e24f1","tenant":"e2e-shared-a-4cd364","userId":"a338c165-e10b-45f1-b89b-a6e56732ac28","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-2e24f1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2e24f1"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","selected_subscription":"e2e-rate-iso-a-2e24f1","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-2e24f1@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c937184f-30fc-4061-bc0b-ce0d2386f8bf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55988","PortSpecifier":{"PortValue":55988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55988","PortSpecifier":{"PortValue":55988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902795,"nanos":109175891},"http":{"id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g\"}"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","subscription":"e2e-rate-iso-a-2e24f1","tenant":"e2e-shared-a-4cd364","userId":"a338c165-e10b-45f1-b89b-a6e56732ac28","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-2e24f1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2e24f1"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","selected_subscription":"e2e-rate-iso-a-2e24f1","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-2e24f1@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aea707c8-c8b5-4aa0-9a53-3d2acd72d92b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55994","PortSpecifier":{"PortValue":55994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","method":"POST","path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions","host":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:55994","PortSpecifier":{"PortValue":55994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902796,"nanos":145051702},"http":{"id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","method":"POST","headers":{":authority":"e2e-shared-a-4cd364.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-DYuTMbWCqUER45Vb_QGHncotQHHrlnMmLN4s9bH0T5eXTDboNyWbFBPAk45g\"}"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","subscription":"e2e-rate-iso-a-2e24f1","tenant":"e2e-shared-a-4cd364","userId":"a338c165-e10b-45f1-b89b-a6e56732ac28","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\",\"requestedSubscription\":\"e2e-rate-iso-a-2e24f1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4cd364.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4cd364/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2e24f1"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"a338c165-e10b-45f1-b89b-a6e56732ac28","keyName":"e2e-rate-a-2e24f1","selected_subscription":"e2e-rate-iso-a-2e24f1","selected_subscription_key":"ai-tenant-e2e-shared-a-4cd364/e2e-rate-iso-a-2e24f1@ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4cd364","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2e24f1","namespace":"ai-tenant-e2e-shared-a-4cd364","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4cd364/rate-test-model-4cd364"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edbe9205-5783-49b3-b9e2-5b2ac291bf4e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34932","PortSpecifier":{"PortValue":34932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b96c51fa-8691-4a9e-843b-53ae45034b39","method":"POST","path":"/ai-tenant-e2e-shared-b-525009/rate-test-model-525009/v1/completions","host":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:34932","PortSpecifier":{"PortValue":34932}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902796,"nanos":182094140},"http":{"id":"b96c51fa-8691-4a9e-843b-53ae45034b39","method":"POST","headers":{":authority":"e2e-shared-b-525009.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-525009/rate-test-model-525009/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OnKOxwKlYDq7WPCO_ljj1l16rWh98ZIWeKw6wwIy5TcOPzfgZeytMrqCv42C"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-525009.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OnKOxwKlYDq7WPCO_ljj1l16rWh98ZIWeKw6wwIy5TcOPzfgZeytMrqCv42C\"}"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-525009.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"85fb1332-97e0-4140-b4d4-2f8a9995fd6b","keyName":"e2e-rate-b-2e24f1","subscription":"e2e-rate-iso-b-2e24f1","tenant":"e2e-shared-b-525009","userId":"85fb1332-97e0-4140-b4d4-2f8a9995fd6b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-525009.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-525009/rate-test-model-525009\",\"requestedSubscription\":\"e2e-rate-iso-b-2e24f1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-525009.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-525009","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2e24f1","namespace":"ai-tenant-e2e-shared-b-525009","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-525009/rate-test-model-525009"}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-525009/rate-test-model-525009\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-525009/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-2e24f1"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"85fb1332-97e0-4140-b4d4-2f8a9995fd6b","keyName":"e2e-rate-b-2e24f1","selected_subscription":"e2e-rate-iso-b-2e24f1","selected_subscription_key":"ai-tenant-e2e-shared-b-525009/e2e-rate-iso-b-2e24f1@ai-tenant-e2e-shared-b-525009/rate-test-model-525009","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-525009","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-2e24f1","namespace":"ai-tenant-e2e-shared-b-525009","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-525009/rate-test-model-525009"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:19:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b96c51fa-8691-4a9e-843b-53ae45034b39","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fad2a6ead71e6f07f0e9b631b23d850db98a79aa379c23fa78a8784e928587f5"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6373a7dfe59a5c8a650695df983ac920bc26ee12ece84b74a7d448295927dcc7"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d27444fdcda9024d80a86c9370cfe665d803317cbadc1a4a0fc09b17750a39c5"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e63fe83adfaa5a68778a46f9924e1f2c889d9118a459199eb9d442c042932359"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ad9fb32ed8ff45a3f5ab59e14b982a91cf13ac03783aaf07448141631dc6d60"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6b7239e995ee08e2c5bb0cbeafa39df38ece9a52b5d51baf79e1a744a824fea0"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44d3f08423c9d4d6a9979ceabec40fc34ada9216c991ef8d7b263caf5a84d051"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b4b1400312ac679479d1fb21dba08a2f82a67a2565193c468cd5e9d2c58f75ad"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d3882a2f51426fcd7f29895dddcbbc232651572c545c3c41dcda785335f96390"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/63ddc3229caecb264328d874a062fbba8d8531cfbb6de53a4a40d6d3d27ffc2c"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb8b8d989fb3f9f9eae59fe37b60737eab7cfa9c4d88ffc9275a277ebc2eeede"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f10018e0e67e79b330919ee17769840a6228ce6bb296959de2d6bbb13a3d1ec0"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a599b706f0f0c009b5017960c48e44accfafa84c78936745707481fde58130b"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f80d35fb76b8d6687d2fe9d619fa18c6c986a929369c2de63fafa9d952849e2d"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3076d6b81c7549caccc08bd752e5e43561b35544387d969f7310b83c620a3b41"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ada1f5111c2b1b9e7283a0b193ba0dea79b78ae3e298bf1bb346122e87bd788"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b796b616f62150e1644f8ca29b5eaeb74140cca14938d304d8136dd87b187388"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0426d55510fcb0f6c7d2556b3c31b039878f89871c0a6486ef366311d8e296cf"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f848b61b1dcefe9280fc6c3a8b0587306734a2aea562b5694c9738aa795ef4c"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5232b63de8949a4bf0818bb1d68ddd5c4a0be4075612a9d6ff644322fe4e107d"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9bbb9e8c59f19fdce72ed3bfbefb0aa0d46a107966a5cce5fdeb25e1f384c18a"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/786b79c25c240d945bb7e9867994571beef56b37eb321fcdda76fe7463f9c0c4"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/886f0607729a08afc974d0f459dd0ab148162a07993894953296cadd8bdcf2b1"}
{"level":"info","ts":"2026-07-24T14:20:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6faa294968314858eeefa1037091374818df6a981113eaf0408a42059ff68b5e"}
{"level":"info","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:46252","PortSpecifier":{"PortValue":46252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"88780e91-abb5-4674-b41b-051ae6cafddb","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:46252","PortSpecifier":{"PortValue":46252}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902870,"nanos":623383735},"http":{"id":"88780e91-abb5-4674-b41b-051ae6cafddb","method":"POST","headers":{":authority":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"88780e91-abb5-4674-b41b-051ae6cafddb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6bf9953-d094-4acc-a979-c79b07394157","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:46264","PortSpecifier":{"PortValue":46264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b6bf9953-d094-4acc-a979-c79b07394157","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b6bf9953-d094-4acc-a979-c79b07394157","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:46264","PortSpecifier":{"PortValue":46264}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.39:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902870,"nanos":678249550},"http":{"id":"b6bf9953-d094-4acc-a979-c79b07394157","method":"POST","headers":{":authority":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EB2YnAlkdtu6b1hH_gj6RcydfUEM6SePR2btOZZKwqjMIboIIfcLE3fpnltv"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EB2YnAlkdtu6b1hH_gj6RcydfUEM6SePR2btOZZKwqjMIboIIfcLE3fpnltv\"}"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"43af32ba-f05a-490f-a25d-a0fe549f3b4c","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"43af32ba-f05a-490f-a25d-a0fe549f3b4c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b6bf9953-d094-4acc-a979-c79b07394157","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.39:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b6bf9953-d094-4acc-a979-c79b07394157","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"43af32ba-f05a-490f-a25d-a0fe549f3b4c","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6bf9953-d094-4acc-a979-c79b07394157","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:21:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b6bf9953-d094-4acc-a979-c79b07394157","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:39Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:39Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb"}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb"}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:39Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:39Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:39Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"}
{"level":"error","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9"}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf"}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d"}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T14:21:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T14:21:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf"}
{"level":"info","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36446","PortSpecifier":{"PortValue":36446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-546fcb.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36446","PortSpecifier":{"PortValue":36446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902908,"nanos":270670960},"http":{"id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","method":"POST","headers":{":authority":"e2e-ipp-a-546fcb.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"83ab8648-81db-477d-9e55-a629748cf17b","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"]}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bf950585557c"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=00549905-8b1f-43eb-9d80-52407084d8d4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"83ab8648-81db-477d-9e55-a629748cf17b","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-546fcb.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-546fcb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:21:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a3d004b-91de-4918-8b85-ee34bb9fda77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36462","PortSpecifier":{"PortValue":36462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","method":"POST","path":"/ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb/v1/chat/completions","host":"e2e-ipp-a-546fcb.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:36462","PortSpecifier":{"PortValue":36462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784902910,"nanos":330917664},"http":{"id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","method":"POST","headers":{":authority":"e2e-ipp-a-546fcb.apps.b4ae6e82-9db2-42e8-8e37-bf950585557c.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-v9OxOgzWnZp42inQ_GUIMlTsJ8a5NundmD5U2pGAMIJoHIQibfa2wEBA8Ejr"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-546fcb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-v9OxOgzWnZp42inQ_GUIMlTsJ8a5NundmD5U2pGAMIJoHIQibfa2wEBA8Ejr\"}"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-546fcb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d7fcdd71-d7de-4806-ba67-eeec416a8b69","keyName":"e2e-ipp-546fcb","subscription":"ipp-route-546fcb-sub","tenant":"e2e-ipp-a-546fcb","userId":"d7fcdd71-d7de-4806-ba67-eeec416a8b69","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-546fcb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb\",\"requestedSubscription\":\"ipp-route-546fcb-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-546fcb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-546fcb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-546fcb-sub","namespace":"ai-tenant-e2e-ipp-a-546fcb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb"}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-546fcb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-546fcb-sub"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d7fcdd71-d7de-4806-ba67-eeec416a8b69","keyName":"e2e-ipp-546fcb","selected_subscription":"ipp-route-546fcb-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb-sub@ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-546fcb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-546fcb-sub","namespace":"ai-tenant-e2e-ipp-a-546fcb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-546fcb/ipp-route-546fcb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T14:21:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ab925e8-2c3b-4148-b5fc-75a9e79ea091","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94de42b90289b92eeae9d3049795f0e12913ec3744e483b5299c6aff36aeb415"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ca1165eca86786387e27814a54d0dcf4b77cb07899458c3c6cb883b8e28ce4bf"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/155670478130ff178dd0bc126879cff0ec8bf1cdf22fcf930cd42d12de16002c"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6345fadc285e44dfbebea3b24bff195f57a9929449caad235085f142872948bb"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0595eeb9094adb850d802d22f416bc780de9e62e7ceba3be87618a7cc4572af8"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e7dde56e7e9ae9509dbee1f775b039c0e9c678508af0b10c242743934292ff9"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e30799f7e8a01236b3fd9d928226c4ae7a473032b46fe987239b18e32ad1390"}
{"level":"info","ts":"2026-07-24T14:23:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2612103d3baea34c09b0c414e4f62727ff320417b4d5c79b4ab4d909e9029ed9"}
{"level":"info","ts":"2026-07-24T14:23:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b14ebe75650007565ff47f5f8b0586f08d45864718e70f1d6de82e6d1a5975d"}
{"level":"info","ts":"2026-07-24T14:23:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3cf7592ce32341ed19f9668eb44fae8b35ef96102845bfce76995e2705a084d"}
{"level":"info","ts":"2026-07-24T14:23:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0aaa37aba697a9d4f9e54cd42ef7f8a378357968341afa8be101ff47ed3c5efb"}
{"level":"info","ts":"2026-07-24T14:23:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/619622bb2da15f5899d7056ed95764f332fc0c65b3376eb4696d766159c77379"}