{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc"}
{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc"}
{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc"}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55120","PortSpecifier":{"PortValue":55120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55120","PortSpecifier":{"PortValue":55120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185697,"nanos":269812828},"http":{"id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6ca7093ebd206c437e7ded6a6bea0f6ab59240dd5f2cb54914777f82c7b46dc4"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3129a3d1-f4c3-47ca-84e9-289a931551fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:58900","PortSpecifier":{"PortValue":58900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:58900","PortSpecifier":{"PortValue":58900}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185697,"nanos":315987048},"http":{"id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","method":"POST","headers":{":authority":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b181ad939a8e5645f8921fe086236031054da630ac068ec704e994320244cfc2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.35:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-21ded0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fedd46d4-29de-4e0d-9095-edab166cd8a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55126","PortSpecifier":{"PortValue":55126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"504c6358-c17f-4b26-96c0-b1ea099da872","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55126","PortSpecifier":{"PortValue":55126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185697,"nanos":356390605},"http":{"id":"504c6358-c17f-4b26-96c0-b1ea099da872","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK\"}"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","subscription":"e2e-rate-iso-a-75432b","tenant":"e2e-shared-a-4af3f5","userId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-75432b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-75432b"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","selected_subscription":"e2e-rate-iso-a-75432b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-75432b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:54:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"504c6358-c17f-4b26-96c0-b1ea099da872","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cffc2824-c654-4632-acae-136216462371","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55134","PortSpecifier":{"PortValue":55134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cffc2824-c654-4632-acae-136216462371","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cffc2824-c654-4632-acae-136216462371","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:55134","PortSpecifier":{"PortValue":55134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185698,"nanos":448921831},"http":{"id":"cffc2824-c654-4632-acae-136216462371","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cffc2824-c654-4632-acae-136216462371","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK\"}"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","subscription":"e2e-rate-iso-a-75432b","tenant":"e2e-shared-a-4af3f5","userId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cffc2824-c654-4632-acae-136216462371","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-75432b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cffc2824-c654-4632-acae-136216462371","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-75432b"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cffc2824-c654-4632-acae-136216462371","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","selected_subscription":"e2e-rate-iso-a-75432b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-75432b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cffc2824-c654-4632-acae-136216462371","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:54:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cffc2824-c654-4632-acae-136216462371","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:33368","PortSpecifier":{"PortValue":33368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54d73fae-cbed-48cb-9461-857b4410e3a6","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:33368","PortSpecifier":{"PortValue":33368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185699,"nanos":502031315},"http":{"id":"54d73fae-cbed-48cb-9461-857b4410e3a6","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RZGp2matmgaXt0Jy_cTKsj6gxkqVbxPnhoyGvYGIljdY3poQieoGSAEGBpJK\"}"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","subscription":"e2e-rate-iso-a-75432b","tenant":"e2e-shared-a-4af3f5","userId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-75432b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-75432b"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b1cfd61f-67e8-4b80-851d-7dcdb3442c51","keyName":"e2e-rate-a-75432b","selected_subscription":"e2e-rate-iso-a-75432b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-75432b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-75432b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:54:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54d73fae-cbed-48cb-9461-857b4410e3a6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39770","PortSpecifier":{"PortValue":39770}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9e096d6e-d830-4107-b098-85f13a641e7c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39770","PortSpecifier":{"PortValue":39770}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185717,"nanos":808123686},"http":{"id":"9e096d6e-d830-4107-b098-85f13a641e7c","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6ca7093ebd206c437e7ded6a6bea0f6ab59240dd5f2cb54914777f82c7b46dc4"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9e096d6e-d830-4107-b098-85f13a641e7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01befc53-56fc-45f7-9449-6df13453d33f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:40090","PortSpecifier":{"PortValue":40090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01befc53-56fc-45f7-9449-6df13453d33f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01befc53-56fc-45f7-9449-6df13453d33f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:40090","PortSpecifier":{"PortValue":40090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185717,"nanos":849846851},"http":{"id":"01befc53-56fc-45f7-9449-6df13453d33f","method":"POST","headers":{":authority":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"01befc53-56fc-45f7-9449-6df13453d33f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01befc53-56fc-45f7-9449-6df13453d33f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b181ad939a8e5645f8921fe086236031054da630ac068ec704e994320244cfc2"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.35:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-21ded0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01befc53-56fc-45f7-9449-6df13453d33f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01befc53-56fc-45f7-9449-6df13453d33f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01befc53-56fc-45f7-9449-6df13453d33f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39780","PortSpecifier":{"PortValue":39780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39780","PortSpecifier":{"PortValue":39780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185717,"nanos":887653180},"http":{"id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT\"}"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","subscription":"e2e-rate-iso-a-8a639b","tenant":"e2e-shared-a-4af3f5","userId":"1b8e6443-95c5-470c-915d-f920feb0f602","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-8a639b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8a639b"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","selected_subscription":"e2e-rate-iso-a-8a639b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-8a639b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fded60e4-6b6f-440c-8a7a-8d80fcdee93f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39784","PortSpecifier":{"PortValue":39784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d745ed4-1f30-48cf-847f-3064477490bb","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39784","PortSpecifier":{"PortValue":39784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185718,"nanos":930042090},"http":{"id":"5d745ed4-1f30-48cf-847f-3064477490bb","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT\"}"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","subscription":"e2e-rate-iso-a-8a639b","tenant":"e2e-shared-a-4af3f5","userId":"1b8e6443-95c5-470c-915d-f920feb0f602","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-8a639b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8a639b"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","selected_subscription":"e2e-rate-iso-a-8a639b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-8a639b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d745ed4-1f30-48cf-847f-3064477490bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53436","PortSpecifier":{"PortValue":53436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","method":"POST","path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions","host":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53436","PortSpecifier":{"PortValue":53436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185719,"nanos":971529262},"http":{"id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","method":"POST","headers":{":authority":"e2e-shared-a-4af3f5.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hXhPumjQs8eEjbZE_cUOiRobyJoSykJLSm0XVgHXHD4iGAxW6LzIoqifgElT\"}"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","subscription":"e2e-rate-iso-a-8a639b","tenant":"e2e-shared-a-4af3f5","userId":"1b8e6443-95c5-470c-915d-f920feb0f602","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\",\"requestedSubscription\":\"e2e-rate-iso-a-8a639b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-4af3f5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8a639b"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1b8e6443-95c5-470c-915d-f920feb0f602","keyName":"e2e-rate-a-8a639b","selected_subscription":"e2e-rate-iso-a-8a639b","selected_subscription_key":"ai-tenant-e2e-shared-a-4af3f5/e2e-rate-iso-a-8a639b@ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-4af3f5/models/facebook/opt-125m","name":"rate-test-model-4af3f5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8a639b","namespace":"ai-tenant-e2e-shared-a-4af3f5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-4af3f5/rate-test-model-4af3f5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c7bc64e2-09ab-4cd8-8d49-55f9382ab743","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:41150","PortSpecifier":{"PortValue":41150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ed605fc-6c05-486e-bf07-e56fbc976133","method":"POST","path":"/ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0/v1/completions","host":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:41150","PortSpecifier":{"PortValue":41150}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.35:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185720,"nanos":10440903},"http":{"id":"6ed605fc-6c05-486e-bf07-e56fbc976133","method":"POST","headers":{":authority":"e2e-shared-b-21ded0.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-CNvuNHQR1iss1tMI_b4bM6UwDpuzdOf8wvKpcaaY86xI6wl6z5HUoohvWkak"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-21ded0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-CNvuNHQR1iss1tMI_b4bM6UwDpuzdOf8wvKpcaaY86xI6wl6z5HUoohvWkak\"}"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-21ded0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d91ca383-26f7-43d1-8558-3d2022509003","keyName":"e2e-rate-b-8a639b","subscription":"e2e-rate-iso-b-8a639b","tenant":"e2e-shared-b-21ded0","userId":"d91ca383-26f7-43d1-8558-3d2022509003","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-21ded0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0\",\"requestedSubscription\":\"e2e-rate-iso-b-8a639b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-21ded0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-21ded0/models/facebook/opt-125m","name":"rate-test-model-21ded0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8a639b","namespace":"ai-tenant-e2e-shared-b-21ded0","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0"}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-21ded0/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-8a639b"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d91ca383-26f7-43d1-8558-3d2022509003","keyName":"e2e-rate-b-8a639b","selected_subscription":"e2e-rate-iso-b-8a639b","selected_subscription_key":"ai-tenant-e2e-shared-b-21ded0/e2e-rate-iso-b-8a639b@ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-21ded0/models/facebook/opt-125m","name":"rate-test-model-21ded0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8a639b","namespace":"ai-tenant-e2e-shared-b-21ded0","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-21ded0/rate-test-model-21ded0"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:55:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ed605fc-6c05-486e-bf07-e56fbc976133","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6233da4841d628da18befb3ef821e438a588c6cece7869de7f2b7785f56ea406"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf924d257ff11d11781eed0560a538bd2a19ce3c6962a80c8507a289ff7a5f33"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0b6a9b625916b248f8c23e6191bb9c31db2ce6251b580aae6ec7c9dcfdcb705a"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d85dd785fb550fe0a2b4c4ccbe2b89f50bf92511f7054eceb1d6ff193b0f753"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b181ad939a8e5645f8921fe086236031054da630ac068ec704e994320244cfc2"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ad4562e7ae7eaa8a8932e05edb89f9fb1131b278942a3bcb0fd3a823565fcca"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b4c61fb8189daafbfa408e98f32238c115b332703bb5a234480ceb89e3b305a"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c241b89957d02017d9b99d27c5231a5b60ff9f9be18424f3ce0df9096ca5586d"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3bc946cef392686bd0e3e7ff3ac34b76c54326469378c8833764d7d99f74ec9a"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2e528f5c9763d2551f8e0c30d6258c447ba4dc87e622b3ae3392e522b50bad99"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ca7093ebd206c437e7ded6a6bea0f6ab59240dd5f2cb54914777f82c7b46dc4"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1bc8b0a7dbc78844d41ac1d13d1136ffcb25829b6168cf6003dae84350a996cc"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aa716b7f1ef7299a3c2a3bc8f4b3469b215d76fccd9aa9ac13f4a5c7e5f75bc8"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6291e2a7e86f9234d2a4214391f422dd7b92ce233670d51e07213123a48b09e3"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/506f991fae9ae94e593fae50c5ef191c8af656b6bf95f549a505973da4658478"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf67a199e729f1070e70e9bb51d7e2f7e53eea5d750b5c90054b5b50274d6fb9"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c320fe03db1ccc21b8de3f0bc163fdc5dfc403f1d0f38912dfb51a46df3ab11e"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd85995904b05a6681831f82e416cbd7a015928825fad00d73d1cf6265f75c66"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02efe55ac81047ccfbaa2847f2132d4f6cacab2e54103d3905318323ace04199"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/395ba9fd1f07022c7c9c42b11700f84e2b817956579fa3b0443481771bf65858"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/17e4ef389e7d40115de5c7867b1bd947c99217b49c4efdb43cf8e2baa0e9d7f8"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e003b8315a7d23128c9b5c58f4da9034de6f30f78dd2ec7b0d6a318964975ad6"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/82201e2e961906a30f8091e3d47ee7ce8a65dfa240a2bf570f8db19187802490"}
{"level":"info","ts":"2026-07-27T20:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa3f486ee1c535b57f843cabd2baf4d134836d40246a462b29d1052e665cc98a"}
{"level":"info","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39530","PortSpecifier":{"PortValue":39530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39530","PortSpecifier":{"PortValue":39530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185783,"nanos":244512497},"http":{"id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","method":"POST","headers":{":authority":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c8e4a61-075c-47b2-af2e-e0169d60c095","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39534","PortSpecifier":{"PortValue":39534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:39534","PortSpecifier":{"PortValue":39534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185783,"nanos":302456908},"http":{"id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","method":"POST","headers":{":authority":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-agriAAMqMYUQr11Z_wTsuLTrWyn6ip7BlfFRw4bKd0qTs94HgSjNQtmhwR7G"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-agriAAMqMYUQr11Z_wTsuLTrWyn6ip7BlfFRw4bKd0qTs94HgSjNQtmhwR7G\"}"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ca8878b6-cd35-46c4-a22e-4652b34ced06","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"ca8878b6-cd35-46c4-a22e-4652b34ced06","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ca8878b6-cd35-46c4-a22e-4652b34ced06","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:56:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5e664fb-1b61-453a-ab08-d0f70dcb94c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"error","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030"}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"debug","ts":"2026-07-27T20:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-27T20:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-27T20:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-366a10.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:44260","PortSpecifier":{"PortValue":44260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185833,"nanos":418125116},"http":{"id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","method":"POST","headers":{":authority":"e2e-ipp-a-366a10.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"19d772c4-5fac-4686-bc33-56d1a767516f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"]}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/2bca7dfdf0a0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8669fa97-e593-41cc-b885-0f6f4ec6b8e7"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"19d772c4-5fac-4686-bc33-56d1a767516f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.82:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-366a10.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-366a10/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:57:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"023252ad-4b6b-41b8-9cc2-b1c957fb07c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","method":"POST","path":"/ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10/v1/chat/completions","host":"e2e-ipp-a-366a10.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:44262","PortSpecifier":{"PortValue":44262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.82:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785185835,"nanos":485107176},"http":{"id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","method":"POST","headers":{":authority":"e2e-ipp-a-366a10.apps.20c5f773-f163-4393-97c6-2bca7dfdf0a0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1AYakyGoLoeLekfo5_fpG59vQ8Wqaz28Jkvhvl25S5x2qYrojZgO1CNwGgdk3"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-366a10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1AYakyGoLoeLekfo5_fpG59vQ8Wqaz28Jkvhvl25S5x2qYrojZgO1CNwGgdk3\"}"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-366a10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3c5b4ec-8069-4612-8634-cdedb31ceeb4","keyName":"e2e-ipp-366a10","subscription":"ipp-route-366a10-sub","tenant":"e2e-ipp-a-366a10","userId":"b3c5b4ec-8069-4612-8634-cdedb31ceeb4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-366a10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10\",\"requestedSubscription\":\"ipp-route-366a10-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-366a10.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-366a10/models/facebook/opt-125m","name":"ipp-route-366a10","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-366a10-sub","namespace":"ai-tenant-e2e-ipp-a-366a10","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10"}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-366a10/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-366a10-sub"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3c5b4ec-8069-4612-8634-cdedb31ceeb4","keyName":"e2e-ipp-366a10","selected_subscription":"ipp-route-366a10-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10-sub@ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-366a10/models/facebook/opt-125m","name":"ipp-route-366a10","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-366a10-sub","namespace":"ai-tenant-e2e-ipp-a-366a10","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-366a10/ipp-route-366a10"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-27T20:57:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa8197db-d961-4d7b-b0cd-d25d0966cee1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7bff7513d646f774f4bb2ad42324b77e602c1ce4aa421e771ee114e7a477abe2"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8cd553e5aab3c355b414cbeb75f3faa9bbb0ded2d9b239b6d75ae99007e4e38f"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16f94acd1d3b7c9fad1ae12750b0a5fa642685c6b7a44b40fc1ae8281dbbd851"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e70fcba1ebb73403d875673606c30762c26d3d60fbf4efb1ff9deea3cf090e09"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc4cb2614dbcf0e850a458355138fcca2b81809c95c98d5793aa96194c9c9717"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fe2f3e1e9d95c2ebea745e59cda569a5ae5ddec301294eb36e1495f67327ad18"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ce80ed08240e4bb772f13f48fbd5f1866cb1aba57d3b1d3d72d04f666c7a972"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d53c327e618aa48438dcdb4203ebc7efdead68dc76309f51c81bad45fc0cd5f0"}
{"level":"info","ts":"2026-07-27T20:58:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b08688a0cdaa811d18e574aa80b75814df80e339d709d3a2ff222508b4f28761"}
{"level":"info","ts":"2026-07-27T20:58:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/335e74072b592f3181a9bd966c5781806d158116785b709c6802c193a6b4dcd5"}
{"level":"info","ts":"2026-07-27T20:58:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39ec610c2d14a3ccc140d872bfa3322279edf100a290911500bf65c299e8c030"}
{"level":"info","ts":"2026-07-27T20:58:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/681f8431b7c28c4ad895afbe057cdbfc4d424c3813ee2f9f41d05642142a84cc"}