{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"error","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T20:00:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"}
{"level":"info","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T20:00:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T20:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc"}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58246","PortSpecifier":{"PortValue":58246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58246","PortSpecifier":{"PortValue":58246}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836806,"nanos":105769807},"http":{"id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"]}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe3e585f-357b-424e-8fa1-b6fb15df76ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51056","PortSpecifier":{"PortValue":51056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:51056","PortSpecifier":{"PortValue":51056}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836806,"nanos":147168751},"http":{"id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","method":"POST","headers":{":authority":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"]}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"48bd525f1d7a436177961a70accfa946199faedc0af125d6de0f6e3288217378"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-829079/rate-test-model-829079\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-829079/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"048889d2-22d2-4ad8-8f28-a2b3b1247f98","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58260","PortSpecifier":{"PortValue":58260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e26d8130-bed0-40da-af78-2f8efea2ec25","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58260","PortSpecifier":{"PortValue":58260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836806,"nanos":185951882},"http":{"id":"e26d8130-bed0-40da-af78-2f8efea2ec25","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e26d8130-bed0-40da-af78-2f8efea2ec25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58262","PortSpecifier":{"PortValue":58262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0bbe22f6-52f2-40e5-8163-203094441f9b","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58262","PortSpecifier":{"PortValue":58262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836807,"nanos":245816227},"http":{"id":"0bbe22f6-52f2-40e5-8163-203094441f9b","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bbe22f6-52f2-40e5-8163-203094441f9b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58276","PortSpecifier":{"PortValue":58276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0647c3cd-99e5-4147-832f-a7453df214ed","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58276","PortSpecifier":{"PortValue":58276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836808,"nanos":283658546},"http":{"id":"0647c3cd-99e5-4147-832f-a7453df214ed","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0647c3cd-99e5-4147-832f-a7453df214ed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a227867-10ad-4b63-8277-add5e543e220","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58280","PortSpecifier":{"PortValue":58280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a227867-10ad-4b63-8277-add5e543e220","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a227867-10ad-4b63-8277-add5e543e220","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58280","PortSpecifier":{"PortValue":58280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836809,"nanos":323447964},"http":{"id":"4a227867-10ad-4b63-8277-add5e543e220","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a227867-10ad-4b63-8277-add5e543e220","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a227867-10ad-4b63-8277-add5e543e220","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a227867-10ad-4b63-8277-add5e543e220","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a227867-10ad-4b63-8277-add5e543e220","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58284","PortSpecifier":{"PortValue":58284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:58284","PortSpecifier":{"PortValue":58284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836810,"nanos":357830769},"http":{"id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d2ef121-7b0c-4aec-ba23-a900674cd18b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53442","PortSpecifier":{"PortValue":53442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53442","PortSpecifier":{"PortValue":53442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836811,"nanos":397426977},"http":{"id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb8f7e69-b8e5-4a4f-af74-0c92db930bc2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53448","PortSpecifier":{"PortValue":53448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"045902b2-ddb5-44c3-abf8-c52f09120e97","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53448","PortSpecifier":{"PortValue":53448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836812,"nanos":431986878},"http":{"id":"045902b2-ddb5-44c3-abf8-c52f09120e97","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"045902b2-ddb5-44c3-abf8-c52f09120e97","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53454","PortSpecifier":{"PortValue":53454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53454","PortSpecifier":{"PortValue":53454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836813,"nanos":466408434},"http":{"id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JV9mTPu2rJPPNALm_a67DrlWhTVZtbJYrsMd7ewEMMS8nxNLaM4UK7MlnfFB\"}"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","subscription":"e2e-rate-iso-a-e09818","tenant":"e2e-shared-a-459a5a","userId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-e09818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e09818"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cd6e16c2-6c54-4916-a5a2-cdde65c77cd3","keyName":"e2e-rate-a-e09818","selected_subscription":"e2e-rate-iso-a-e09818","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-e09818@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e09818","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"871fd327-5f9c-4d60-8ddc-2e8a161e2d6d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55810","PortSpecifier":{"PortValue":55810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55810","PortSpecifier":{"PortValue":55810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836822,"nanos":45108817},"http":{"id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"]}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a2a345b9-fcbb-4a8d-bc0c-8f3df6c36edf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48014","PortSpecifier":{"PortValue":48014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5c717a2-29a2-40d5-b355-022216ff0451","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48014","PortSpecifier":{"PortValue":48014}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836822,"nanos":78272709},"http":{"id":"b5c717a2-29a2-40d5-b355-022216ff0451","method":"POST","headers":{":authority":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"]}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/dd34667a78c6"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=15a4e93e-966d-4104-abd4-e3cc15cd28c2"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"2ae20781-ffad-4c45-b99b-81e537399fc2","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"48bd525f1d7a436177961a70accfa946199faedc0af125d6de0f6e3288217378"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-829079/rate-test-model-829079\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-829079/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5c717a2-29a2-40d5-b355-022216ff0451","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55824","PortSpecifier":{"PortValue":55824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"336c8c99-5690-44e8-a8bd-84298e252df5","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55824","PortSpecifier":{"PortValue":55824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836822,"nanos":111367549},"http":{"id":"336c8c99-5690-44e8-a8bd-84298e252df5","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im\"}"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","subscription":"e2e-rate-iso-a-7deea4","tenant":"e2e-shared-a-459a5a","userId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-7deea4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7deea4"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","selected_subscription":"e2e-rate-iso-a-7deea4","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-7deea4@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"336c8c99-5690-44e8-a8bd-84298e252df5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55830","PortSpecifier":{"PortValue":55830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"242c6dd6-edb9-4320-bce7-918b3aabff25","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55830","PortSpecifier":{"PortValue":55830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836823,"nanos":148581209},"http":{"id":"242c6dd6-edb9-4320-bce7-918b3aabff25","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im\"}"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","subscription":"e2e-rate-iso-a-7deea4","tenant":"e2e-shared-a-459a5a","userId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-7deea4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7deea4"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","selected_subscription":"e2e-rate-iso-a-7deea4","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-7deea4@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"242c6dd6-edb9-4320-bce7-918b3aabff25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55836","PortSpecifier":{"PortValue":55836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","method":"POST","path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions","host":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55836","PortSpecifier":{"PortValue":55836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836824,"nanos":181449322},"http":{"id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","method":"POST","headers":{":authority":"e2e-shared-a-459a5a.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1NAAosjSsQ0I3b08t_XRxkDOwxIYgj0qlozbG2JMUqo3hxPGpudccH9R4U8im\"}"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","subscription":"e2e-rate-iso-a-7deea4","tenant":"e2e-shared-a-459a5a","userId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\",\"requestedSubscription\":\"e2e-rate-iso-a-7deea4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-459a5a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-459a5a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7deea4"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4ef45d1e-834a-4ad3-94a5-fa11c6eb72f4","keyName":"e2e-rate-a-7deea4","selected_subscription":"e2e-rate-iso-a-7deea4","selected_subscription_key":"ai-tenant-e2e-shared-a-459a5a/e2e-rate-iso-a-7deea4@ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-459a5a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7deea4","namespace":"ai-tenant-e2e-shared-a-459a5a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-459a5a/rate-test-model-459a5a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8594e980-74ae-45ad-a077-9fedfeba0fdd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48018","PortSpecifier":{"PortValue":48018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"41b8d70c-afce-474d-80fd-b191bfe898c2","method":"POST","path":"/ai-tenant-e2e-shared-b-829079/rate-test-model-829079/v1/completions","host":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48018","PortSpecifier":{"PortValue":48018}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784836824,"nanos":217317133},"http":{"id":"41b8d70c-afce-474d-80fd-b191bfe898c2","method":"POST","headers":{":authority":"e2e-shared-b-829079.apps.438ec68a-cdbd-4db7-a174-dd34667a78c6.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-829079/rate-test-model-829079/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-OLwEm7i1OtwvyzGD_oi8x8nVD7hQg14AfJHcZGVRfXkXejOtTRyKvWyaCw5F"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-829079.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-OLwEm7i1OtwvyzGD_oi8x8nVD7hQg14AfJHcZGVRfXkXejOtTRyKvWyaCw5F\"}"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-829079.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1fcc1322-6676-42e9-a929-84d8478f6c3b","keyName":"e2e-rate-b-7deea4","subscription":"e2e-rate-iso-b-7deea4","tenant":"e2e-shared-b-829079","userId":"1fcc1322-6676-42e9-a929-84d8478f6c3b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-829079.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-829079/rate-test-model-829079\",\"requestedSubscription\":\"e2e-rate-iso-b-7deea4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-829079.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-829079","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7deea4","namespace":"ai-tenant-e2e-shared-b-829079","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-829079/rate-test-model-829079"}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-829079/rate-test-model-829079\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-829079/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-7deea4"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1fcc1322-6676-42e9-a929-84d8478f6c3b","keyName":"e2e-rate-b-7deea4","selected_subscription":"e2e-rate-iso-b-7deea4","selected_subscription_key":"ai-tenant-e2e-shared-b-829079/e2e-rate-iso-b-7deea4@ai-tenant-e2e-shared-b-829079/rate-test-model-829079","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-829079","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7deea4","namespace":"ai-tenant-e2e-shared-b-829079","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-829079/rate-test-model-829079"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T20:00:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"41b8d70c-afce-474d-80fd-b191bfe898c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8706e31cb4d4d7d00b58da6de42453e348e9724f7d019cfa273075a698e25549"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16deb1fb81467647c16c5953dcd4582f5bb9ed6a5808186098b2074b2ea644bb"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9ab757776b1cd206cf00f8e9fc8dd18d7ed41cbbebfe75a02c356da8b6e2dd3"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cccbe84f7a1f1420d47f4073710999f3a5c63b86106425fb62c007cdb7c427e4"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2169922e2b4df92e0710b42b812c7e022e14130380ab0cec1e9c7b5c7dfa24c"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9430316220473e0d308b3ba396745dd2e9584297a1d4ad223f2735ace3753e2"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b80fe57128a50597e15890147fa33361217dcf52ab5e3dbfe13cb9114e90286"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c2079275bf880f1ae226da064bed0d341a877a16ff4743f74cb319c92d17fb5"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6eb2250104c5b307e888a741d1290bae1bc167e361e7b3fcbd50bdd181a0f7f"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/48bd525f1d7a436177961a70accfa946199faedc0af125d6de0f6e3288217378"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/82cce104e372959cd8d6f4b1791493dfc4279bf9e994c3119e486461537032fd"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9a85465bcce4cd7b0f7cdb37a2bc7b35f2ecf3d48787f6e1b3f29f72ad04132"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40f6a7ec9da6d389f2ed14cfc55061b731fcefc562703c600a758670b4d17a58"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90895e0eaed7296da23ffc257f39079c84a87451150489dc0ee603ab2890def9"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fec09359323ce39310da2d961e0b7f169e18b4e9db22a06823bfb799abe2c83f"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9fe7835b8e8a13d5627357e593a664efe2a629375c42ce864fdc687c1970f20c"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fea2d1ab37a7e9c174b2639cb45a7c14a7f6aed18dcf242455133b7deeca001d"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e29b7918898b92a2e2bf2161567a36e07645cfbb5df755e2968110bb0df8a163"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d4edca761511b473d94a0a1419ea33590629673a11db958209f8b650b6637bcf"}
{"level":"info","ts":"2026-07-23T20:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57537bc5aeff9823cf5d87ba205537c7a21681b3ccae7e702a5b5f7ff71705cb"}
{"level":"info","ts":"2026-07-23T20:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84e18604da38081cc8179de21806ddbad817ad7e08052f36e9d9161bab41e9c6"}
{"level":"info","ts":"2026-07-23T20:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c5f4d3f397139210d7d6b31e4f7fa32f0c681455ac30d121f4c69ebcf52004c"}
{"level":"info","ts":"2026-07-23T20:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/95cf999a25c9beab9d60e1873e1bb4438ae9080ddefd9b5cd07bf3c8bb13bbfc"}
{"level":"info","ts":"2026-07-23T20:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab1bbca26f27c6d3b676424e3f63afd2ee93c2ce7995c2ecbf1ae28fdaea4ab8"}