{"level":"debug","ts":"2026-07-25T02:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1415f4b5-b3a5-4624-8c02-bfa9e9fb749a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:03:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1415f4b5-b3a5-4624-8c02-bfa9e9fb749a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c189f3d8-6376-4829-b23d-c4704f37a284","keyName":"e2e-rate-a-f150b4","selected_subscription":"e2e-rate-iso-a-f150b4","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-f150b4@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f150b4","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1415f4b5-b3a5-4624-8c02-bfa9e9fb749a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:03:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1415f4b5-b3a5-4624-8c02-bfa9e9fb749a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:41294","PortSpecifier":{"PortValue":41294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:41294","PortSpecifier":{"PortValue":41294}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945038,"nanos":680629958},"http":{"id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-AYNFXoyzc5fov6Nv_B1WSEaZW5gdt8EABwf1SEAcdVdFNmstKsJkrE8zqy7f"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-AYNFXoyzc5fov6Nv_B1WSEaZW5gdt8EABwf1SEAcdVdFNmstKsJkrE8zqy7f\"}"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c189f3d8-6376-4829-b23d-c4704f37a284","keyName":"e2e-rate-a-f150b4","subscription":"e2e-rate-iso-a-f150b4","tenant":"e2e-shared-a-299af2","userId":"c189f3d8-6376-4829-b23d-c4704f37a284","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-f150b4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f150b4","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f150b4"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c189f3d8-6376-4829-b23d-c4704f37a284","keyName":"e2e-rate-a-f150b4","selected_subscription":"e2e-rate-iso-a-f150b4","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-f150b4@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f150b4","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:03:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4bab1ec2-5f7d-4387-bc40-bcd3eccce8e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42328","PortSpecifier":{"PortValue":42328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42328","PortSpecifier":{"PortValue":42328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945058,"nanos":21242675},"http":{"id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"211064f4-b761-48dc-9620-7a48c6271ba5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"]}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"211064f4-b761-48dc-9620-7a48c6271ba5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"54d43d35eca47c2acf73ca97f3099b03878d409fb871d5d01f1b20323e6c7f25"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.74:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76bc3288-7d8f-4824-ac9a-2b14e2415739","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:57414","PortSpecifier":{"PortValue":57414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ab0ae6.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:57414","PortSpecifier":{"PortValue":57414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945058,"nanos":60510361},"http":{"id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","method":"POST","headers":{":authority":"e2e-shared-b-ab0ae6.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"211064f4-b761-48dc-9620-7a48c6271ba5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"]}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"211064f4-b761-48dc-9620-7a48c6271ba5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"49a88367acb83838d3114f0a5e59829bae82242b928cea1f8e69dd36848d22da"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ab0ae6.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-ab0ae6/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a0e783c-78cc-4732-87c4-ce236ae475d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"52a343a3-9083-4628-96f9-beeffd524f90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42332","PortSpecifier":{"PortValue":42332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"52a343a3-9083-4628-96f9-beeffd524f90","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"52a343a3-9083-4628-96f9-beeffd524f90","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42332","PortSpecifier":{"PortValue":42332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945058,"nanos":92223226},"http":{"id":"52a343a3-9083-4628-96f9-beeffd524f90","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"52a343a3-9083-4628-96f9-beeffd524f90","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"52a343a3-9083-4628-96f9-beeffd524f90","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"52a343a3-9083-4628-96f9-beeffd524f90","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"52a343a3-9083-4628-96f9-beeffd524f90","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42344","PortSpecifier":{"PortValue":42344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42344","PortSpecifier":{"PortValue":42344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945059,"nanos":131197030},"http":{"id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7649c07b-afd3-4cd7-8a42-189cbe38f48f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42346","PortSpecifier":{"PortValue":42346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42346","PortSpecifier":{"PortValue":42346}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945060,"nanos":174487566},"http":{"id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05c9439d-3e11-4bfa-b40d-5f51aee360b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44656","PortSpecifier":{"PortValue":44656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44656","PortSpecifier":{"PortValue":44656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945061,"nanos":212467999},"http":{"id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dfe3fc2-71d0-448b-8ee3-bbdcc8453b36","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44662","PortSpecifier":{"PortValue":44662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44662","PortSpecifier":{"PortValue":44662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945062,"nanos":243712903},"http":{"id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d6b7261-6a0a-4a7c-ad4c-05ef60840967","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44674","PortSpecifier":{"PortValue":44674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44674","PortSpecifier":{"PortValue":44674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945063,"nanos":279991008},"http":{"id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f660cdad-2aac-4bff-8bfe-b342a40bf0a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce936cec-8677-40cc-a06e-279c66693a78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44688","PortSpecifier":{"PortValue":44688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce936cec-8677-40cc-a06e-279c66693a78","method":"POST","path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions","host":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce936cec-8677-40cc-a06e-279c66693a78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44688","PortSpecifier":{"PortValue":44688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.74:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945064,"nanos":313421445},"http":{"id":"ce936cec-8677-40cc-a06e-279c66693a78","method":"POST","headers":{":authority":"e2e-shared-a-299af2.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-HkXYEs5ZC2iwR5K_UKCuwXKSL0K7n6XH1TcymGLsIlg1vTWaIceBCQAstxS\"}"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","subscription":"e2e-rate-iso-a-0eea97","tenant":"e2e-shared-a-299af2","userId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\",\"requestedSubscription\":\"e2e-rate-iso-a-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-299af2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce936cec-8677-40cc-a06e-279c66693a78","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce936cec-8677-40cc-a06e-279c66693a78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ee70b6d-bc68-48fc-819d-228eda1fb87e","keyName":"e2e-rate-a-0eea97","selected_subscription":"e2e-rate-iso-a-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-a-299af2/e2e-rate-iso-a-0eea97@ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-299af2/models/facebook/opt-125m","name":"rate-test-model-299af2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eea97","namespace":"ai-tenant-e2e-shared-a-299af2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-299af2/rate-test-model-299af2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce936cec-8677-40cc-a06e-279c66693a78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce936cec-8677-40cc-a06e-279c66693a78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:37074","PortSpecifier":{"PortValue":37074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea4011d8-558d-40db-acd5-cfb794d0a248","method":"POST","path":"/ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6/v1/completions","host":"e2e-shared-b-ab0ae6.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:37074","PortSpecifier":{"PortValue":37074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945064,"nanos":344534785},"http":{"id":"ea4011d8-558d-40db-acd5-cfb794d0a248","method":"POST","headers":{":authority":"e2e-shared-b-ab0ae6.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-pSAnGlxTpG0xB16K_wv2EVgpIQeukeIv4f6xw46oJclTauEh6Cf3nuVhBWp3"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-ab0ae6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-pSAnGlxTpG0xB16K_wv2EVgpIQeukeIv4f6xw46oJclTauEh6Cf3nuVhBWp3\"}"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ab0ae6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"368afb56-23c1-4265-94f8-11d5ea1d9f58","keyName":"e2e-rate-b-0eea97","subscription":"e2e-rate-iso-b-0eea97","tenant":"e2e-shared-b-ab0ae6","userId":"368afb56-23c1-4265-94f8-11d5ea1d9f58","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-ab0ae6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6\",\"requestedSubscription\":\"e2e-rate-iso-b-0eea97\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ab0ae6.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-ab0ae6/models/facebook/opt-125m","name":"rate-test-model-ab0ae6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-0eea97","namespace":"ai-tenant-e2e-shared-b-ab0ae6","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6"}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-ab0ae6/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-0eea97"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"368afb56-23c1-4265-94f8-11d5ea1d9f58","keyName":"e2e-rate-b-0eea97","selected_subscription":"e2e-rate-iso-b-0eea97","selected_subscription_key":"ai-tenant-e2e-shared-b-ab0ae6/e2e-rate-iso-b-0eea97@ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-ab0ae6/models/facebook/opt-125m","name":"rate-test-model-ab0ae6","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-0eea97","namespace":"ai-tenant-e2e-shared-b-ab0ae6","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-ab0ae6/rate-test-model-ab0ae6"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:04:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea4011d8-558d-40db-acd5-cfb794d0a248","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:04:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b74ffa4d1b91a626e163ac7b17570c0fbf31e75249e5f32f0df629bc85c096d2"}
{"level":"info","ts":"2026-07-25T02:04:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d19af75ed1e30fb7825dcba3a8a15c143d92fb837fb8377656fa2533c970a04f"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ae653ba4d660d86a7ecf38bc41ddd08eeb9a6630721303fd99bb511367b1ee15"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c368bf03d130f5b4c08e02ce76f31c5951e3e825aa61c7cfa9f784527804c141"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/700089b1f1a398ac6c39bb2f06809c951398a444c2d500ded66dacebeb28a0b6"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b59cf000b74ba28bd1e2ec6ec3e9b0121533e97447719b14dfa7fa041fe36e1"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ba0f324f56e5adaa707dcb86810150b0574b4b00af64fe4b296f01c6e9a403b9"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/94929090dfd5fca88e041630dc56aabf79a2b67e28bdab89a90446ccf44073ad"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/828991559dfad1ba5e30633f8c353df45a15358d31c1207426da3e0db7e8dfb8"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/54d43d35eca47c2acf73ca97f3099b03878d409fb871d5d01f1b20323e6c7f25"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2443188aeecfbb0ba8f45ddb45b07a22b5dd3c623d4ebf20d23b1511da18ebb5"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8c7feae761fda2eff2e264f8f58bc2d5985af7af9bc3fab9360709d05bf8daa"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/856954c660cf8c261136dba77c9f312596f57837d130af41c9eef9a8d2746330"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee6f811d0e31dc42d7f18510cd0ce4e51318892146e7a8be5d942bb0d548cd35"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50cd808506b48a84f5d7b801e5118c897711ab05115952d1555dd34ef4718136"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0584c62a08d70f5b603dab69e462f05cbc703fb10e806d3e068090c72df46f7c"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16d392815cdef6e562edf755339befc0333310c2cc2b6a670fafc25729e9f2e6"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aabb74e76087ccdc4f5a17a006d1882a18afdeaaace9f954db248274f2d39d7f"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62e3d8e0de8ba8c76b3dfb6a6da8338df930017b763ddb14243581024be506d5"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/49a88367acb83838d3114f0a5e59829bae82242b928cea1f8e69dd36848d22da"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db6ed41907f509d95b38178c7f96c074077e20355b04651e7385a6a7d9caceab"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf2766446d85f6044c0c911a11e8e1c6b03b729c9324e49874839819935d247d"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e3c2b267034f77c79d5fa4ed5fe0304fb9ca65027252c8da8b3391af38a50f6"}
{"level":"info","ts":"2026-07-25T02:04:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/43cba6fe8a31cdd8ee8245cd057ce46f4183651fbeec856de373f6ea7a485303"}
{"level":"info","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36842","PortSpecifier":{"PortValue":36842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"602930b7-eb27-429b-8b65-ecd537a7ca22","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36842","PortSpecifier":{"PortValue":36842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945128,"nanos":914919112},"http":{"id":"602930b7-eb27-429b-8b65-ecd537a7ca22","method":"POST","headers":{":authority":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"211064f4-b761-48dc-9620-7a48c6271ba5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"]}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"211064f4-b761-48dc-9620-7a48c6271ba5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"602930b7-eb27-429b-8b65-ecd537a7ca22","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36848","PortSpecifier":{"PortValue":36848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36848","PortSpecifier":{"PortValue":36848}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945128,"nanos":966320386},"http":{"id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","method":"POST","headers":{":authority":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1MDMSFGSu9QgtQb7k_Duy09ewHU8ShrA2nz4rkyULRzxlOrMiRi5mMtqnVKDW"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1MDMSFGSu9QgtQb7k_Duy09ewHU8ShrA2nz4rkyULRzxlOrMiRi5mMtqnVKDW\"}"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7109d752-6a6c-4604-8b24-c0f9279dfab1","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"7109d752-6a6c-4604-8b24-c0f9279dfab1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7109d752-6a6c-4604-8b24-c0f9279dfab1","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:05:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fb7af7b-55aa-4cd4-9b99-456dc4bbc2fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"debug","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"}
{"level":"error","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"error","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15"}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-25T02:06:06Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"error","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-25T02:06:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36684","PortSpecifier":{"PortValue":36684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.91:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-e22c40.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36684","PortSpecifier":{"PortValue":36684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.91:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945184,"nanos":296669979},"http":{"id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","method":"POST","headers":{":authority":"e2e-ipp-a-e22c40.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"211064f4-b761-48dc-9620-7a48c6271ba5","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"]}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bcbf4fa061d3"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c2caad05-e8ed-4111-bb17-d5e30fe695c4"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"211064f4-b761-48dc-9620-7a48c6271ba5","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.91:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-e22c40.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-e22c40/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:06:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e07d4c2-0166-4ec7-b097-f61ab2f95a0d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36700","PortSpecifier":{"PortValue":36700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.91:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66f87f08-a390-4dc8-802c-784a32e6108f","method":"POST","path":"/ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40/v1/chat/completions","host":"e2e-ipp-a-e22c40.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:36700","PortSpecifier":{"PortValue":36700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.91:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784945186,"nanos":354492936},"http":{"id":"66f87f08-a390-4dc8-802c-784a32e6108f","method":"POST","headers":{":authority":"e2e-ipp-a-e22c40.apps.49833dae-128d-429d-9f60-bcbf4fa061d3.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-99xqKmZf3UPUNGzl_1V5OMnbYHlTksUv1hVYVWyvuyHl1mK87qlCfjMhKLPd"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-e22c40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-99xqKmZf3UPUNGzl_1V5OMnbYHlTksUv1hVYVWyvuyHl1mK87qlCfjMhKLPd\"}"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-e22c40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"401f350d-c5e1-457b-aec2-a3b9e02c4251","keyName":"e2e-ipp-e22c40","subscription":"ipp-route-e22c40-sub","tenant":"e2e-ipp-a-e22c40","userId":"401f350d-c5e1-457b-aec2-a3b9e02c4251","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-e22c40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40\",\"requestedSubscription\":\"ipp-route-e22c40-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-e22c40.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-e22c40/models/facebook/opt-125m","name":"ipp-route-e22c40","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-e22c40-sub","namespace":"ai-tenant-e2e-ipp-a-e22c40","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40"}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-e22c40/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-e22c40-sub"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"401f350d-c5e1-457b-aec2-a3b9e02c4251","keyName":"e2e-ipp-e22c40","selected_subscription":"ipp-route-e22c40-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40-sub@ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-e22c40/models/facebook/opt-125m","name":"ipp-route-e22c40","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-e22c40-sub","namespace":"ai-tenant-e2e-ipp-a-e22c40","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-e22c40/ipp-route-e22c40"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-25T02:06:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66f87f08-a390-4dc8-802c-784a32e6108f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-25T02:07:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad24032a1bf6df8af7d61649ebc6a97fb9cc506f56a1e0c6ac2f0851b9cf3356"}
{"level":"info","ts":"2026-07-25T02:07:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b52da58f078cf1d812b56b814b4b905275c84920e794f1bba7569df6f5baa6e6"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c53f027f133fae4f83ddfa6555a41da35989e2cb7a7e90f4d164ee0a7d9a0b2f"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0672132df7e59deac0b91a67eda7c6d304214431a577fdfb2f8e675d959f4d22"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd52ff6d0b43c40334fbb10b21ed12652040de6d6a19a41c74ce7db707847661"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5342b567899cba4228dd0204d9d1fb5c2f0d6a42cc637f50c751120ce0c4bd0"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/acaaa28114121e2486ab19b88c254128226890c449e754eb300e947728faf626"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/78b091561a8139efcd1663ff2a5c669cc7086b729a338db61e13c50abea3ee15"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/569fb06b27feb436071eeaa90078b230cfda55d15d3a8fc3757167c31686f18c"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9e357a253ee0d2eb7aea6d181a504e054ff202cf2c06b52bae74e123d1790a14"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf77fee96030c374370f4d6197969152928c8125df5a877dd98ff0f76f2d2ac3"}
{"level":"info","ts":"2026-07-25T02:07:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/def4146d022f6c4631670e5a8d857db411c70028b2ec579c16d9d54f6467a078"}