{"level":"info","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"debug","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"debug","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:27:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:27:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:27:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:27:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"info","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:27:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:27:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:27:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43400","PortSpecifier":{"PortValue":43400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5068b660-0fbe-4572-96d4-8abc248c740e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43400","PortSpecifier":{"PortValue":43400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910459,"nanos":197087390},"http":{"id":"5068b660-0fbe-4572-96d4-8abc248c740e","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"]}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"65a05e5caf088aa3eb05dc8ca0cf130c6503b9fefdb25267b7b8550d29e1e439"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.63:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5068b660-0fbe-4572-96d4-8abc248c740e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57844","PortSpecifier":{"PortValue":57844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5aebfb.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57844","PortSpecifier":{"PortValue":57844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910459,"nanos":241820662},"http":{"id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","method":"POST","headers":{":authority":"e2e-shared-b-5aebfb.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"]}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"27e7cf35f624f931afeeef1e3d788a7f1fcf8cd21ecd9196e450d5bf43b0793d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5aebfb.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5aebfb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"835dba42-3d5f-4abf-b60b-e3bdd3be4bf7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43414","PortSpecifier":{"PortValue":43414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ae63b33-94cb-48ef-8443-23340ad91050","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43414","PortSpecifier":{"PortValue":43414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910459,"nanos":285042124},"http":{"id":"8ae63b33-94cb-48ef-8443-23340ad91050","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae63b33-94cb-48ef-8443-23340ad91050","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43424","PortSpecifier":{"PortValue":43424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a907769-cf75-40ca-947f-64b26ca40bec","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43424","PortSpecifier":{"PortValue":43424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910460,"nanos":381423467},"http":{"id":"0a907769-cf75-40ca-947f-64b26ca40bec","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a907769-cf75-40ca-947f-64b26ca40bec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43426","PortSpecifier":{"PortValue":43426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43426","PortSpecifier":{"PortValue":43426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910461,"nanos":423884999},"http":{"id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d02c56f8-6d6e-48cf-8859-70b79f1c2c54","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43442","PortSpecifier":{"PortValue":43442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43442","PortSpecifier":{"PortValue":43442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910462,"nanos":465650811},"http":{"id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24f4c3ef-7058-486c-8b59-470e5fdf268a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43452","PortSpecifier":{"PortValue":43452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5739b1ed-864f-40a6-b857-722d6242d7cd","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43452","PortSpecifier":{"PortValue":43452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910463,"nanos":503743722},"http":{"id":"5739b1ed-864f-40a6-b857-722d6242d7cd","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5739b1ed-864f-40a6-b857-722d6242d7cd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"949cee95-2199-4e5c-bea9-8c6042676650","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43460","PortSpecifier":{"PortValue":43460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"949cee95-2199-4e5c-bea9-8c6042676650","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"949cee95-2199-4e5c-bea9-8c6042676650","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43460","PortSpecifier":{"PortValue":43460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910464,"nanos":546337159},"http":{"id":"949cee95-2199-4e5c-bea9-8c6042676650","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"949cee95-2199-4e5c-bea9-8c6042676650","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"949cee95-2199-4e5c-bea9-8c6042676650","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"949cee95-2199-4e5c-bea9-8c6042676650","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"949cee95-2199-4e5c-bea9-8c6042676650","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43464","PortSpecifier":{"PortValue":43464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e863bcd6-db13-4aab-beea-0f81ead54628","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43464","PortSpecifier":{"PortValue":43464}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910465,"nanos":589327783},"http":{"id":"e863bcd6-db13-4aab-beea-0f81ead54628","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e863bcd6-db13-4aab-beea-0f81ead54628","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43466","PortSpecifier":{"PortValue":43466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","method":"POST","path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions","host":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43466","PortSpecifier":{"PortValue":43466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.63:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910466,"nanos":627917700},"http":{"id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","method":"POST","headers":{":authority":"e2e-shared-a-ed0643.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Lh0MwP6cbyu8dJQ2_bRheMvKbDNYQy9rXOtvJAcDC6lGzRGLswXpRsbKy0ts\"}"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","subscription":"e2e-rate-iso-a-7c1ae6","tenant":"e2e-shared-a-ed0643","userId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\",\"requestedSubscription\":\"e2e-rate-iso-a-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ed0643.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ed0643/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ddc2630b-1bfe-49b8-a18f-2a90c35b4a51","keyName":"e2e-rate-a-7c1ae6","selected_subscription":"e2e-rate-iso-a-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-a-ed0643/e2e-rate-iso-a-7c1ae6@ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ed0643","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-7c1ae6","namespace":"ai-tenant-e2e-shared-a-ed0643","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-ed0643/rate-test-model-ed0643"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d86f8aa-b1a3-476a-92bc-d07b51abc112","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57850","PortSpecifier":{"PortValue":57850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","method":"POST","path":"/ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb/v1/completions","host":"e2e-shared-b-5aebfb.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57850","PortSpecifier":{"PortValue":57850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910466,"nanos":671499612},"http":{"id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","method":"POST","headers":{":authority":"e2e-shared-b-5aebfb.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nhFYiq9SZMODRSit_LffGRKcJiod4PQYoCS4ZVJIdX9cXZ0UrinShlHLbYmp"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5aebfb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nhFYiq9SZMODRSit_LffGRKcJiod4PQYoCS4ZVJIdX9cXZ0UrinShlHLbYmp\"}"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5aebfb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"15e1f718-4d60-406a-90b5-63f1fb18e72f","keyName":"e2e-rate-b-7c1ae6","subscription":"e2e-rate-iso-b-7c1ae6","tenant":"e2e-shared-b-5aebfb","userId":"15e1f718-4d60-406a-90b5-63f1fb18e72f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5aebfb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb\",\"requestedSubscription\":\"e2e-rate-iso-b-7c1ae6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5aebfb.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5aebfb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7c1ae6","namespace":"ai-tenant-e2e-shared-b-5aebfb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb"}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-5aebfb/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-7c1ae6"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"15e1f718-4d60-406a-90b5-63f1fb18e72f","keyName":"e2e-rate-b-7c1ae6","selected_subscription":"e2e-rate-iso-b-7c1ae6","selected_subscription_key":"ai-tenant-e2e-shared-b-5aebfb/e2e-rate-iso-b-7c1ae6@ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5aebfb","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-7c1ae6","namespace":"ai-tenant-e2e-shared-b-5aebfb","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-5aebfb/rate-test-model-5aebfb"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:27:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0863c4f0-5c86-4b72-a629-8759673cf7e0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a774672f41bed0001704c3d959ff2f205e646d64ad2ea68d5c9e6e2b139a0b56"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e1a32132f940cba06b35a3b9ac8addd3ddc6f94f65911491825ad00123169b65"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6261f024732d1097d2e96713e2fcc16f2c230fd898da3c2a48a62505ca112df5"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/042da6707f201ae6d8804010ed85ff61a669ac9a1271cbb6c06dfe6637e7e435"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0e6bea3b0c7c678a5666aecb6cd9ff3bb84c923b8e4a3fd3c47bd0b0b9d12b7"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7cdcc140d474766fbf78903ac42523a1b8bd7de766263713f7c6862e6b1da620"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/65a05e5caf088aa3eb05dc8ca0cf130c6503b9fefdb25267b7b8550d29e1e439"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc5a757f30f68581505e84ff6ed5b882938952f5669a0032470a754c245cba8e"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b371e7f1ef334f49771461ddd98c30f4c5ac6b407ae1fea86ba6f4953b97bd0e"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a2bdc8f00a17c7273f3b44c46dfeee1bbe2e6f792348ad60dda2770320c5e56"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d928067a20f53b1304c3576bba75ffc644c6718aaf96b24c4d28543243ff4d9"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/faafcf9320247d413a534f265b9782677255cd6250f6bb184ee7490e069b0bd0"}
{"level":"info","ts":"2026-07-24T16:27:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b24bde9914e8731006cf333f82d6b8c09491b9f8ce8da73eb57bb55a4f535add"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/48d3b9dc378c54d754abf0a734b996da961a369b4240c3b00fd4d57603b71f96"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/27e7cf35f624f931afeeef1e3d788a7f1fcf8cd21ecd9196e450d5bf43b0793d"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d4421d7904f69de4e880c07db79637248e62c95fac72104219a015801cba49eb"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c284c260b5757670d6fde22017a948509a3b3c7160e740cef61088b7c9276c63"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b60bf71b45b02afc4df1ff9a7570848dd80c1fda334f1e2170f93c9cfe7d23f"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3fa17cf8c68718b0cfeb74219bd2a450f0b0fb221412d5e9716d02aec05f3d82"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f5eaae02c05ecd3a047192a576d6aa24ae3b9b389218fbdeeef1283130e2bf69"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3226656291cb96dac3c1fdb2ac93465ef763be48e5d9d8e3f6822f404a548e16"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d860650c596d5f05f4d6aac01ad58918059b7ce02fdd4b2928bd3c9d81d342c"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6dd550013b48240375a3cc7bbea43f0ca84ab105b1aeb20278c7ebee333868a"}
{"level":"info","ts":"2026-07-24T16:27:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3be3582f66f55f5ccc58346cab4af44572b463c30f547cd3a5ee8e8e013111ec"}
{"level":"info","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44292","PortSpecifier":{"PortValue":44292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44292","PortSpecifier":{"PortValue":44292}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910532,"nanos":801839265},"http":{"id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","method":"POST","headers":{":authority":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"]}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"787db6fe-383b-4c60-a2ae-ca4f50e5581b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5a30190-3864-4475-8065-21c3d170ed11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44308","PortSpecifier":{"PortValue":44308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5a30190-3864-4475-8065-21c3d170ed11","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5a30190-3864-4475-8065-21c3d170ed11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:44308","PortSpecifier":{"PortValue":44308}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.36:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910532,"nanos":857859724},"http":{"id":"b5a30190-3864-4475-8065-21c3d170ed11","method":"POST","headers":{":authority":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-MJ41Iqxf1j63Rgb9_6uZc2v5RIK7jNVlEBcbOwS5MUIajTygSaxJ4aeCS4TA"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-MJ41Iqxf1j63Rgb9_6uZc2v5RIK7jNVlEBcbOwS5MUIajTygSaxJ4aeCS4TA\"}"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f69c7698-909c-450e-a2d8-22e9166fcaac","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"f69c7698-909c-450e-a2d8-22e9166fcaac","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5a30190-3864-4475-8065-21c3d170ed11","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.36:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5a30190-3864-4475-8065-21c3d170ed11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f69c7698-909c-450e-a2d8-22e9166fcaac","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5a30190-3864-4475-8065-21c3d170ed11","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:28:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5a30190-3864-4475-8065-21c3d170ed11","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325"}
{"level":"error","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325"}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513"}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325"}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T16:29:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T16:29:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa"}
{"level":"info","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33152","PortSpecifier":{"PortValue":33152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7dc7949b-d072-4601-8830-8ddf41022cb2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-2c5dfe.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33152","PortSpecifier":{"PortValue":33152}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910590,"nanos":22984007},"http":{"id":"7dc7949b-d072-4601-8830-8ddf41022cb2","method":"POST","headers":{":authority":"e2e-ipp-a-2c5dfe.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"]}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3fcef645f7d4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b69c2ad1-d6d8-41a5-b870-b74bc82df959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ba969b21-a465-4893-bc3a-4af4f140dc9f","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-2c5dfe.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-2c5dfe/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:29:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7dc7949b-d072-4601-8830-8ddf41022cb2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a3aa2c6-bf62-4734-af81-e049bb905035","method":"POST","path":"/ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe/v1/chat/completions","host":"e2e-ipp-a-2c5dfe.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:33166","PortSpecifier":{"PortValue":33166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784910592,"nanos":90262297},"http":{"id":"4a3aa2c6-bf62-4734-af81-e049bb905035","method":"POST","headers":{":authority":"e2e-ipp-a-2c5dfe.apps.ef1a55c5-d8cf-42f6-b56d-3fcef645f7d4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-185fI9aKcVqRZ8VRa_aNTeiPzszp5kGVWamvtR6EaMZnLgVh6PugI3btcHbjG"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-2c5dfe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-185fI9aKcVqRZ8VRa_aNTeiPzszp5kGVWamvtR6EaMZnLgVh6PugI3btcHbjG\"}"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-2c5dfe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d178ea61-4ae2-4b9c-813e-5c785fbfab8a","keyName":"e2e-ipp-2c5dfe","subscription":"ipp-route-2c5dfe-sub","tenant":"e2e-ipp-a-2c5dfe","userId":"d178ea61-4ae2-4b9c-813e-5c785fbfab8a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-2c5dfe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe\",\"requestedSubscription\":\"ipp-route-2c5dfe-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-2c5dfe.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-2c5dfe","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-2c5dfe-sub","namespace":"ai-tenant-e2e-ipp-a-2c5dfe","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe"}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-2c5dfe/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-2c5dfe-sub"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d178ea61-4ae2-4b9c-813e-5c785fbfab8a","keyName":"e2e-ipp-2c5dfe","selected_subscription":"ipp-route-2c5dfe-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe-sub@ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-2c5dfe","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-2c5dfe-sub","namespace":"ai-tenant-e2e-ipp-a-2c5dfe","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-2c5dfe/ipp-route-2c5dfe"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T16:29:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a3aa2c6-bf62-4734-af81-e049bb905035","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9188b71ab00cd6005d9ceecbfecce5b239d39c3e62f5b92a34fa7d2f6eccfe8f"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a56f75cf2c0baa57ac9ab907a25dd8ff0163d7b1f6f7b2a75c7ff110f17c20e5"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e09954db2255e538c681da288912e6efdfa879b47c1325b28a402b2f14a181fa"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1fd1c09a88553f54d6647d908f5d569563e81764692eb2563494305a6c609ae"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7501d3167e044703f63ee23fd58f7b775f5879db040d27250f45e512b6f06a5"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bac731a8bf3cf219fd593536741be3502e910adb887b0a69e8bd95d8408f3ba6"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fddc1c8aa1d01d77f4fd1a031001cf989442286b8165829143004e20e50ec513"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c5066dcd949d5605d5147539c0dcef3585f23b0a39a5bcaa7c4c436405bf752"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24f19fb81b1c729b2a3c7d720a90a8b4087467d9e7b95e738b0615b7a74b0325"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/901c9a171376e95312fa605d8f65dc9df8a9635fd5227a0fbebd59a8656af05e"}
{"level":"info","ts":"2026-07-24T16:30:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/abff1af668e8393aa6768c9f20c9af35ff329f94331834be5c0d61d8c233ec9b"}
{"level":"info","ts":"2026-07-24T16:30:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0697c116a2d3889e226d7dd6776349905b4b740d27e544f80c5f6c067956bdb5"}