{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"}
{"level":"error","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd"}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4"}
{"level":"debug","ts":"2026-07-16T23:02:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a"}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718"}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8"}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a"}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-16T23:02:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-16T23:02:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"873f878d-ed8f-477e-b338-16edbe4889af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53468","PortSpecifier":{"PortValue":53468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"873f878d-ed8f-477e-b338-16edbe4889af","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"873f878d-ed8f-477e-b338-16edbe4889af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53468","PortSpecifier":{"PortValue":53468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242929,"nanos":638928921},"http":{"id":"873f878d-ed8f-477e-b338-16edbe4889af","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"873f878d-ed8f-477e-b338-16edbe4889af","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"]}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"873f878d-ed8f-477e-b338-16edbe4889af","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"873f878d-ed8f-477e-b338-16edbe4889af","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"873f878d-ed8f-477e-b338-16edbe4889af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"873f878d-ed8f-477e-b338-16edbe4889af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41880","PortSpecifier":{"PortValue":41880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93411bd5-6273-4fce-9968-c83f26a38ff1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41880","PortSpecifier":{"PortValue":41880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242929,"nanos":684601737},"http":{"id":"93411bd5-6273-4fce-9968-c83f26a38ff1","method":"POST","headers":{":authority":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"]}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5159e9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93411bd5-6273-4fce-9968-c83f26a38ff1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53484","PortSpecifier":{"PortValue":53484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53484","PortSpecifier":{"PortValue":53484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242929,"nanos":730754016},"http":{"id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9f7c856-d5a7-9928-b2dc-fae2c91b05e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53490","PortSpecifier":{"PortValue":53490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7a7bc267-aa8f-4767-bbd2-f76329095964","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53490","PortSpecifier":{"PortValue":53490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242930,"nanos":795642283},"http":{"id":"7a7bc267-aa8f-4767-bbd2-f76329095964","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7a7bc267-aa8f-4767-bbd2-f76329095964","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53500","PortSpecifier":{"PortValue":53500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53500","PortSpecifier":{"PortValue":53500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242931,"nanos":834246981},"http":{"id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a6a5e36-668f-42a0-aa13-54bda7f09143","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc375025-87cc-414d-b654-63369fcf8de6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53504","PortSpecifier":{"PortValue":53504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fc375025-87cc-414d-b654-63369fcf8de6","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc375025-87cc-414d-b654-63369fcf8de6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53504","PortSpecifier":{"PortValue":53504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242932,"nanos":876770677},"http":{"id":"fc375025-87cc-414d-b654-63369fcf8de6","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fc375025-87cc-414d-b654-63369fcf8de6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc375025-87cc-414d-b654-63369fcf8de6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc375025-87cc-414d-b654-63369fcf8de6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc375025-87cc-414d-b654-63369fcf8de6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53514","PortSpecifier":{"PortValue":53514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53514","PortSpecifier":{"PortValue":53514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242933,"nanos":920674522},"http":{"id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45a35a03-67ac-4263-a38f-a6e90454fbe4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53526","PortSpecifier":{"PortValue":53526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53526","PortSpecifier":{"PortValue":53526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242934,"nanos":962491155},"http":{"id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51b418d7-e1cc-427f-a44e-aa8ab1b34c4b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53540","PortSpecifier":{"PortValue":53540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53540","PortSpecifier":{"PortValue":53540}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242935,"nanos":998984623},"http":{"id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-14CP1GPhuiT8bjkDH_2edIPJprQyeadzXzVnQtiAK7yNssraaLAVv9QG0QtgU\"}"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","subscription":"e2e-rate-iso-a-cd68d7","tenant":"e2e-shared-a-35a77a","userId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-cd68d7\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd68d7"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14f988e6-9ea0-4248-9c72-413a76a62b4d","keyName":"e2e-rate-a-cd68d7","selected_subscription":"e2e-rate-iso-a-cd68d7","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-cd68d7@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd68d7","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ced0a52f-baa9-4734-969b-bd27f689e7b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54552","PortSpecifier":{"PortValue":54552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54552","PortSpecifier":{"PortValue":54552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242944,"nanos":789997624},"http":{"id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"]}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3cc837b-bef2-48ad-b856-0c1a288c3b29","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:34756","PortSpecifier":{"PortValue":34756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:34756","PortSpecifier":{"PortValue":34756}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242944,"nanos":832851203},"http":{"id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","method":"POST","headers":{":authority":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"]}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/55b8d91eab51"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=c5c15593-ca47-45a8-abd8-b8047efa7a35"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"a4ba86b6-3614-492f-a9e6-eead973e3208","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5159e9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ce299fe-43f3-4a34-9cb2-7f430f130fcd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddb170fb-902a-4e44-a269-babae008bff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54562","PortSpecifier":{"PortValue":54562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddb170fb-902a-4e44-a269-babae008bff2","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddb170fb-902a-4e44-a269-babae008bff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54562","PortSpecifier":{"PortValue":54562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242944,"nanos":869906053},"http":{"id":"ddb170fb-902a-4e44-a269-babae008bff2","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1\"}"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","subscription":"e2e-rate-iso-a-5ed220","tenant":"e2e-shared-a-35a77a","userId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-5ed220\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddb170fb-902a-4e44-a269-babae008bff2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ed220"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddb170fb-902a-4e44-a269-babae008bff2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","selected_subscription":"e2e-rate-iso-a-5ed220","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-5ed220@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddb170fb-902a-4e44-a269-babae008bff2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddb170fb-902a-4e44-a269-babae008bff2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54572","PortSpecifier":{"PortValue":54572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54572","PortSpecifier":{"PortValue":54572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242945,"nanos":908349735},"http":{"id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1\"}"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","subscription":"e2e-rate-iso-a-5ed220","tenant":"e2e-shared-a-35a77a","userId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-5ed220\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ed220"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","selected_subscription":"e2e-rate-iso-a-5ed220","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-5ed220@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c6d4c0a-fa2a-444e-8139-b8bdf8bef6e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54574","PortSpecifier":{"PortValue":54574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c8ad902-ac46-462e-ae48-7ff013674139","method":"POST","path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions","host":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54574","PortSpecifier":{"PortValue":54574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242946,"nanos":949166180},"http":{"id":"1c8ad902-ac46-462e-ae48-7ff013674139","method":"POST","headers":{":authority":"e2e-shared-a-35a77a.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-11ZUhp7lGJAWHAMaY_GtBt4cWxRYhwr6GIWLdvnbVVf1zbiSwt2cZPdHiHLK1\"}"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","subscription":"e2e-rate-iso-a-5ed220","tenant":"e2e-shared-a-35a77a","userId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\",\"requestedSubscription\":\"e2e-rate-iso-a-5ed220\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-35a77a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-35a77a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ed220"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d90007c6-2fb1-4a1f-b151-6f6109074daf","keyName":"e2e-rate-a-5ed220","selected_subscription":"e2e-rate-iso-a-5ed220","selected_subscription_key":"ai-tenant-e2e-shared-a-35a77a/e2e-rate-iso-a-5ed220@ai-tenant-e2e-shared-a-35a77a/rate-test-model-35a77a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-35a77a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ed220","namespace":"ai-tenant-e2e-shared-a-35a77a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c8ad902-ac46-462e-ae48-7ff013674139","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:34764","PortSpecifier":{"PortValue":34764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dce3a350-9dd4-40af-a948-0e496d7e9407","method":"POST","path":"/ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9/v1/completions","host":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:34764","PortSpecifier":{"PortValue":34764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784242946,"nanos":992862257},"http":{"id":"dce3a350-9dd4-40af-a948-0e496d7e9407","method":"POST","headers":{":authority":"e2e-shared-b-5159e9.apps.c38411af-70ef-4c13-b4af-55b8d91eab51.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-16J3oPHFg2tEweBPO_eu55yG1zXfp33uAY1JuIbZNasQQOCQ4sk08dsrELQTM"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5159e9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-16J3oPHFg2tEweBPO_eu55yG1zXfp33uAY1JuIbZNasQQOCQ4sk08dsrELQTM\"}"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5159e9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"09cc0fbe-1460-49ba-ab0b-49578f8625be","keyName":"e2e-rate-b-5ed220","subscription":"e2e-rate-iso-b-5ed220","tenant":"e2e-shared-b-5159e9","userId":"09cc0fbe-1460-49ba-ab0b-49578f8625be","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5159e9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9\",\"requestedSubscription\":\"e2e-rate-iso-b-5ed220\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5159e9.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5159e9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5ed220","namespace":"ai-tenant-e2e-shared-b-5159e9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5159e9/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-5ed220"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"09cc0fbe-1460-49ba-ab0b-49578f8625be","keyName":"e2e-rate-b-5ed220","selected_subscription":"e2e-rate-iso-b-5ed220","selected_subscription_key":"ai-tenant-e2e-shared-b-5159e9/e2e-rate-iso-b-5ed220@ai-tenant-e2e-shared-b-5159e9/rate-test-model-5159e9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5159e9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-5ed220","namespace":"ai-tenant-e2e-shared-b-5159e9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T23:02:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dce3a350-9dd4-40af-a948-0e496d7e9407","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2f746c96de1ad8b2424897bceb09c2f4a360c2e21f8ffd4d25c67ea5c4721728"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6122136f15f037a5326afe6b763a24f0a7f55ae11f5c4934d3295a83d2a76d23"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b2fe0a6f589335faf3e1c7b3edd0da72048543ae81bcc8a64d9caa8415df1f7"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/242cee1de3016ad91a79cab474241979ff6458e3cf106596e4e1ac233e567c08"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/99a28204c5b60823626b71bd48a483149558a74409446a90dd3d422d745e172a"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9df69755210dc9ba89fdd4d3d1e3b759c28c05df414f59d2480cab9be74f3ac1"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1932f083d46caefc0711fd9eaa59c8ae4a45c0afbec61ff4a0e0954533648dbd"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71ef892932c21830ca7565a0d539ff69400945cb40281b6ef1b7575b9c9fc2a6"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1f558b425a44338d3024168061c9a5217e47edf4531c8de1883a8a98db396ed"}
{"level":"info","ts":"2026-07-16T23:02:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b116ddc2ced900be2cd7022cc97cfca5c72cca89209f4d5164f0383ab8076718"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/898ca0c3eb91b0faab7f360bf2b61ba8fbe54c54cdeb88166508322549b49c3a"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e7ae1fc54ec89583ee482c4350b30d6386151935232aa472aeb4cbb413992f1"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/10cfa9e394b3eaee39444b15e1dc01f62514f09a167848a0fbdf842e323f46bc"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4ff2e4644f056082aee5f5be0b8d4b0cd9d20ae1eb9f9ca8ab179bcc33d776a"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c459d93dd903161b1f8ab37fec833e9654f53d704749d6e59c8a1639d1a3f5c4"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f09d4c30a233d8403effb860b804239c3e476203382196619727adb72dae8575"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe1b4d68b1db9cb92ddee84a89d64a42fbe0df2c3c2e8641936e4d15c40e7b7e"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18eb5602bb487e6a5991729fca90e7ef37fba0968a72554db51ba9f4298dd0a8"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66351775b18873808bade80960a1cee6c97aa4aab200d8187503a299baaa9cdb"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ef3f9467b7061abe35e60df2ac02062635d119db6f46e5ce8dbca3429112c17"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0358f7f9f837a3d8dcc39dfb5b6616d49d75cd9bad255dc4274fc2c32008b6bc"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eadda2739adab33ba1b46a789514fb0019795990009bf2f00e3a0bcb59ffc042"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56839567caca4650f66208dd6f4c72fcd57c8dde3d13eafb99cb577a8ca3110d"}
{"level":"info","ts":"2026-07-16T23:02:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40e18662a9383900b760f633044b9a740b7c3d3e4302c6faf4ad53ce63c37da3"}