{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4"}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"info","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"error","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"23eed94162db143d2b7a3352b6f41604f816d0b0aa2c7c0ff98ef291acdc2703","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"}
{"level":"debug","ts":"2026-07-06T20:01:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/23eed94162db143d2b7a3352b6f41604f816d0b0aa2c7c0ff98ef291acdc2703"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ae175f8434a9806ba270c54380b1d96ccff1d81060edb597e72185e0f542caa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ae175f8434a9806ba270c54380b1d96ccff1d81060edb597e72185e0f542caa"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"feb4b59bbd1c1d90810ccb6b9c531898439f17ce5aad4a3c0f6abac1cc05c152","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/feb4b59bbd1c1d90810ccb6b9c531898439f17ce5aad4a3c0f6abac1cc05c152"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e29c3b40f4247fd9973615773f89e8f19eaf780c5efa53dfeba7505f4783f4b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e29c3b40f4247fd9973615773f89e8f19eaf780c5efa53dfeba7505f4783f4b"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T20:01:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T20:01:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T20:01:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T20:01:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30bd12c719adf4fb9d3cdfd58da0df058c07f11c6f3984d893d901b41a471c87","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c8d46867a0435b3e21b519b6cfd6432c0541101cdf6eb19b4d75a15afa0d7521","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/30bd12c719adf4fb9d3cdfd58da0df058c07f11c6f3984d893d901b41a471c87"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c8d46867a0435b3e21b519b6cfd6432c0541101cdf6eb19b4d75a15afa0d7521"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f931f041d6c66ee9e303f9cb6645fa8b3a8d3389e9081af001252306ea3eecc7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05e573b13e0a58e20c085b096d8508b6f81f555c8381abffb7c221bedf346584","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f931f041d6c66ee9e303f9cb6645fa8b3a8d3389e9081af001252306ea3eecc7"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b7576b8e021ad8679d24070b38c166fb50cbfc8eed3dc37baa547f94111efa4e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05e573b13e0a58e20c085b096d8508b6f81f555c8381abffb7c221bedf346584"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18823b67df48e35f0352a611123b5b82a129bb3b5dbcfc2680839ed1bea31d2c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b7576b8e021ad8679d24070b38c166fb50cbfc8eed3dc37baa547f94111efa4e"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a4f25c8b9bc4956fed944746a7dd308865dbc29ed34d4e5d6c6d692d7e63ae2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18823b67df48e35f0352a611123b5b82a129bb3b5dbcfc2680839ed1bea31d2c"}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f8a4cad10337d249d3c2c539738d04faab0c591316643f90e9bd2070b1e8ccf5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a9a0a5c755219ce9f574b38e3cf1d011cb744f74e666d6f27a1201f31438c12","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a4f25c8b9bc4956fed944746a7dd308865dbc29ed34d4e5d6c6d692d7e63ae2"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f8a4cad10337d249d3c2c539738d04faab0c591316643f90e9bd2070b1e8ccf5"}
{"level":"info","ts":"2026-07-06T20:01:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a9a0a5c755219ce9f574b38e3cf1d011cb744f74e666d6f27a1201f31438c12"}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39996","PortSpecifier":{"PortValue":39996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39996","PortSpecifier":{"PortValue":39996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368104,"nanos":561897154},"http":{"id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"52e7d17e-0d8f-449f-85d4-e56824942111","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"]}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"52e7d17e-0d8f-449f-85d4-e56824942111","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3a4f25c8b9bc4956fed944746a7dd308865dbc29ed34d4e5d6c6d692d7e63ae2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2702904f-eabe-4f7e-b6c5-aeebfe3f8ae7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:32770","PortSpecifier":{"PortValue":32770}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20108e08-307f-4a7e-bd85-ee3583843cb0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:32770","PortSpecifier":{"PortValue":32770}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368104,"nanos":631380581},"http":{"id":"20108e08-307f-4a7e-bd85-ee3583843cb0","method":"POST","headers":{":authority":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"52e7d17e-0d8f-449f-85d4-e56824942111","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"]}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"52e7d17e-0d8f-449f-85d4-e56824942111","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f931f041d6c66ee9e303f9cb6645fa8b3a8d3389e9081af001252306ea3eecc7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20108e08-307f-4a7e-bd85-ee3583843cb0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40000","PortSpecifier":{"PortValue":40000}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40000","PortSpecifier":{"PortValue":40000}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368104,"nanos":675328013},"http":{"id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD\"}"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","subscription":"e2e-rate-iso-a-2b0f51","tenant":"e2e-shared-a-9cb33a","userId":"65987a6a-17e7-4633-a688-9620fe7d712e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-2b0f51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2b0f51"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","selected_subscription":"e2e-rate-iso-a-2b0f51","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-2b0f51@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6c55f4b-522b-486f-8528-aa45fdfe03c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40006","PortSpecifier":{"PortValue":40006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40006","PortSpecifier":{"PortValue":40006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368105,"nanos":741900794},"http":{"id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD\"}"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","subscription":"e2e-rate-iso-a-2b0f51","tenant":"e2e-shared-a-9cb33a","userId":"65987a6a-17e7-4633-a688-9620fe7d712e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-2b0f51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2b0f51"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","selected_subscription":"e2e-rate-iso-a-2b0f51","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-2b0f51@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a19d395-8a77-45c5-8b2f-756085b1aa3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40008","PortSpecifier":{"PortValue":40008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e675a640-7251-4dd3-a9e4-cda721725b15","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40008","PortSpecifier":{"PortValue":40008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368106,"nanos":784932907},"http":{"id":"e675a640-7251-4dd3-a9e4-cda721725b15","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-q07KSE44g7ekvAHU_1cfDH8Lh6efOXsv3SqZcto1z2r1mCahT22K01nrMMbD\"}"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","subscription":"e2e-rate-iso-a-2b0f51","tenant":"e2e-shared-a-9cb33a","userId":"65987a6a-17e7-4633-a688-9620fe7d712e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-2b0f51\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2b0f51"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"65987a6a-17e7-4633-a688-9620fe7d712e","keyName":"e2e-rate-a-2b0f51","selected_subscription":"e2e-rate-iso-a-2b0f51","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-2b0f51@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2b0f51","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e675a640-7251-4dd3-a9e4-cda721725b15","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51058","PortSpecifier":{"PortValue":51058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51058","PortSpecifier":{"PortValue":51058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368115,"nanos":481311876},"http":{"id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"52e7d17e-0d8f-449f-85d4-e56824942111","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"]}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"52e7d17e-0d8f-449f-85d4-e56824942111","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3a4f25c8b9bc4956fed944746a7dd308865dbc29ed34d4e5d6c6d692d7e63ae2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3473c1b0-1b73-4792-9ed8-8fb99a953b4f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9accabaa-e794-428a-bd08-3898cb913601","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41446","PortSpecifier":{"PortValue":41446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9accabaa-e794-428a-bd08-3898cb913601","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9accabaa-e794-428a-bd08-3898cb913601","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41446","PortSpecifier":{"PortValue":41446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368115,"nanos":521873096},"http":{"id":"9accabaa-e794-428a-bd08-3898cb913601","method":"POST","headers":{":authority":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9accabaa-e794-428a-bd08-3898cb913601","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"52e7d17e-0d8f-449f-85d4-e56824942111","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"]}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9accabaa-e794-428a-bd08-3898cb913601","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6eee29bfda4b"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=69656434-4c73-4427-b04a-f159e0638096"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"52e7d17e-0d8f-449f-85d4-e56824942111","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f931f041d6c66ee9e303f9cb6645fa8b3a8d3389e9081af001252306ea3eecc7"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9accabaa-e794-428a-bd08-3898cb913601","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9accabaa-e794-428a-bd08-3898cb913601","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9accabaa-e794-428a-bd08-3898cb913601","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51074","PortSpecifier":{"PortValue":51074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"191bd6e3-342f-4315-a9af-92b26c0703c4","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51074","PortSpecifier":{"PortValue":51074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368115,"nanos":560975269},"http":{"id":"191bd6e3-342f-4315-a9af-92b26c0703c4","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"191bd6e3-342f-4315-a9af-92b26c0703c4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51086","PortSpecifier":{"PortValue":51086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51086","PortSpecifier":{"PortValue":51086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368116,"nanos":596256272},"http":{"id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb65d3e3-dca0-43cd-8ba1-63a9ee081860","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51092","PortSpecifier":{"PortValue":51092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51092","PortSpecifier":{"PortValue":51092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368117,"nanos":632551140},"http":{"id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d032093-5c28-4e4f-8bac-1c2860a434fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51108","PortSpecifier":{"PortValue":51108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"583ec576-f60c-4456-8400-c86fcddd3d21","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51108","PortSpecifier":{"PortValue":51108}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368118,"nanos":668275301},"http":{"id":"583ec576-f60c-4456-8400-c86fcddd3d21","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"583ec576-f60c-4456-8400-c86fcddd3d21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51122","PortSpecifier":{"PortValue":51122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51122","PortSpecifier":{"PortValue":51122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368119,"nanos":701878882},"http":{"id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:01:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"657d445e-d665-4642-8e1a-78bfe0cc23d9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51138","PortSpecifier":{"PortValue":51138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7c50859-d279-4c71-8b43-12b99e697da5","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51138","PortSpecifier":{"PortValue":51138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368120,"nanos":736566746},"http":{"id":"e7c50859-d279-4c71-8b43-12b99e697da5","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:02:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7c50859-d279-4c71-8b43-12b99e697da5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51148","PortSpecifier":{"PortValue":51148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4d355917-4e62-47fb-85b4-2f229de3045e","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51148","PortSpecifier":{"PortValue":51148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368121,"nanos":779476930},"http":{"id":"4d355917-4e62-47fb-85b4-2f229de3045e","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:02:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4d355917-4e62-47fb-85b4-2f229de3045e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51150","PortSpecifier":{"PortValue":51150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51150","PortSpecifier":{"PortValue":51150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368122,"nanos":820097604},"http":{"id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:02:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00b9da63-b6e0-9b36-876a-5d9886c5d65b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51158","PortSpecifier":{"PortValue":51158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","method":"POST","path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions","host":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51158","PortSpecifier":{"PortValue":51158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368123,"nanos":856800686},"http":{"id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","method":"POST","headers":{":authority":"e2e-shared-a-9cb33a.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11IL24kDjz72u1XKv_1y8SRiFcBgw8phzdWVRRZKhCerHI58OuHM8Jc5pQwci\"}"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","subscription":"e2e-rate-iso-a-a8fa9b","tenant":"e2e-shared-a-9cb33a","userId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\",\"requestedSubscription\":\"e2e-rate-iso-a-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-9cb33a.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4edeca08-6dca-44d5-97c2-fd676bf54a79","keyName":"e2e-rate-a-a8fa9b","selected_subscription":"e2e-rate-iso-a-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-a-9cb33a/e2e-rate-iso-a-a8fa9b@ai-tenant-e2e-shared-a-9cb33a/rate-test-model-9cb33a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9cb33a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8fa9b","namespace":"ai-tenant-e2e-shared-a-9cb33a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9939ff0c-db1a-49f9-b965-f5507cbc3ca4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41460","PortSpecifier":{"PortValue":41460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7a34824-cf3a-42e7-adde-923d427063f3","method":"POST","path":"/ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc/v1/completions","host":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41460","PortSpecifier":{"PortValue":41460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783368123,"nanos":893826495},"http":{"id":"a7a34824-cf3a-42e7-adde-923d427063f3","method":"POST","headers":{":authority":"e2e-shared-b-97cecc.apps.747a9c9a-c404-4fdb-898b-6eee29bfda4b.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1NmtYZ68Msipq6Hnl_sRDaeb6AqbbKjXzTIS1zHEwfXknzuKysBc5ykP0JIJW"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-97cecc.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1NmtYZ68Msipq6Hnl_sRDaeb6AqbbKjXzTIS1zHEwfXknzuKysBc5ykP0JIJW\"}"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-97cecc.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"20fb53ab-f607-4430-85df-d75222c92e55","keyName":"e2e-rate-b-a8fa9b","subscription":"e2e-rate-iso-b-a8fa9b","tenant":"e2e-shared-b-97cecc","userId":"20fb53ab-f607-4430-85df-d75222c92e55","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-97cecc.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc\",\"requestedSubscription\":\"e2e-rate-iso-b-a8fa9b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-97cecc.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-97cecc","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8fa9b","namespace":"ai-tenant-e2e-shared-b-97cecc","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-a8fa9b"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"20fb53ab-f607-4430-85df-d75222c92e55","keyName":"e2e-rate-b-a8fa9b","selected_subscription":"e2e-rate-iso-b-a8fa9b","selected_subscription_key":"ai-tenant-e2e-shared-b-97cecc/e2e-rate-iso-b-a8fa9b@ai-tenant-e2e-shared-b-97cecc/rate-test-model-97cecc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-97cecc","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8fa9b","namespace":"ai-tenant-e2e-shared-b-97cecc","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T20:02:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7a34824-cf3a-42e7-adde-923d427063f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T20:02:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b7576b8e021ad8679d24070b38c166fb50cbfc8eed3dc37baa547f94111efa4e"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18823b67df48e35f0352a611123b5b82a129bb3b5dbcfc2680839ed1bea31d2c"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a9a0a5c755219ce9f574b38e3cf1d011cb744f74e666d6f27a1201f31438c12"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/030017454e1eb3cec63d2a4beb8eed904879c5d632a5b79a11a4d4750675509b"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05e573b13e0a58e20c085b096d8508b6f81f555c8381abffb7c221bedf346584"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2ae175f8434a9806ba270c54380b1d96ccff1d81060edb597e72185e0f542caa"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f8a4cad10337d249d3c2c539738d04faab0c591316643f90e9bd2070b1e8ccf5"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/636509c29a92ccfc576a933ff87789bccd3eb922973e3e9e8a6243997a5858f4"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/324ab4615bb7091e71c7f76cb3a80e2abdb4414183839ed1b50357beaf47ab00"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/feb4b59bbd1c1d90810ccb6b9c531898439f17ce5aad4a3c0f6abac1cc05c152"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8d46867a0435b3e21b519b6cfd6432c0541101cdf6eb19b4d75a15afa0d7521"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a16a5a3f10524b2059f06fc0407f746f52c65f1a842054d21d00fde3d28d8a04"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dbf3f47262bc736ed821013de85813a9dbd3e272f144bcd476a282043a22f8a4"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad67f019afb803aa420daacb5a57f28f1bea52e934b07e12bdf146df6d99da63"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b7b847b92f71f794853daf17ef8da901a0a96c609402000b04f12a300a3a831"}
{"level":"info","ts":"2026-07-06T20:02:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30bd12c719adf4fb9d3cdfd58da0df058c07f11c6f3984d893d901b41a471c87"}
{"level":"info","ts":"2026-07-06T20:02:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a4f25c8b9bc4956fed944746a7dd308865dbc29ed34d4e5d6c6d692d7e63ae2"}
{"level":"info","ts":"2026-07-06T20:02:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/23eed94162db143d2b7a3352b6f41604f816d0b0aa2c7c0ff98ef291acdc2703"}
{"level":"info","ts":"2026-07-06T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f931f041d6c66ee9e303f9cb6645fa8b3a8d3389e9081af001252306ea3eecc7"}
{"level":"info","ts":"2026-07-06T20:02:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e29c3b40f4247fd9973615773f89e8f19eaf780c5efa53dfeba7505f4783f4b"}